Dfat inadvertently revealed the email addresses of almost 3,000 vulnerable Australians stranded overseas in a data breach. The addresses were included in an email sent to multiple recipients before midday by the Covid-19 consular operations section of Dfat. The addressees were mistakenly listed in the ‘to’ field, rather than ‘bcc’, making them visible to other recipients. No other personal information of any recipient was disclosed.