Hacker "2019" Leaks Data of 25,000 ACMI Customers in Third-Party Breach A hacker known as 2019 has published the personal data of over 25,000 customers of the Australian Centre for the Moving Image (ACMI) on a hacking forum. The leaked datasets allegedly include full names, email addresses, gender, dates of birth, sign-in credentials, invoicing details, and IP addresses. The breach appears linked to Ferve, a Melbourne-based ticketing provider used by ACMI and previously compromised in a similar attack on the Melbourne International Film Festival (MIFF), also claimed by 2019. Ferve has confirmed an ongoing investigation, collaborating with affected clients, cybersecurity experts, and authorities to assess the incident’s scope. The company stated it is evaluating additional security measures to strengthen its systems. ACMI, a prominent Melbourne-based museum and cultural hub focused on film, TV, and digital media, has not yet responded to requests for comment. Ferve serves major clients across Australia, North America, the EU, and Asia-Pacific, including the Sydney Film Festival and Sydney Fringe Festival. The threat actor 2019 has been active since February 2026, with at least 23 tracked breaches targeting organizations in Australia, New Zealand, Spain, the UAE, and the U.S. Some data is offered for direct download, while other leaks are sold. The breach underscores the risks of third-party vendor vulnerabilities in high-profile cultural and event sectors.

Hacker Leaks 360,000 Records from Australian Catering Firm Hampr A hacker known as 2019 has released over 360,000 records allegedly stolen from Hampr, an Australian corporate catering company, on a popular hacking forum. The data, posted on 31 May, was made freely available and includes two sets of compromised information. The first dataset contains customer IDs, names, mobile numbers, and account details, while the second includes dietary preferences, payment details, billing information, and workspace data. Hampr, which serves clients such as Nespresso, CBRE, and Cisco, has not responded to requests for comment. The threat actor, 2019, has been active since at least February 2026 and has previously targeted Australian organizations, including the Melbourne International Film Festival (MIFF). MIFF confirmed a third-party breach via its ticketing platform, Ferve, which exposed customer names, emails, phone numbers, and addresses but not full credit card details or passwords. Australia remains one of 2019’s most frequently targeted countries, alongside Spain, the UAE, and the USA. The hacker has shared data from 20 victims across multiple leak posts. Hampr, headquartered in Sydney, provides corporate catering services with a digital dashboard for order tracking and event management.

Melbourne International Film Festival (MIFF) Hit by Data Breach Affecting 26,700 Customers The Melbourne International Film Festival (MIFF) has confirmed a data breach linked to its third-party ticketing provider, Ferve, exposing the personal information of over 26,700 customers roughly 10% of its database. The incident came to light on May 29, with affected users reporting unusual messages, including texts featuring sad face emojis and emails referencing Miley Cyrus. One email, purportedly from MIFF and titled "Critical Security Incident," contained only the phrase: "i feel like miley cyrus sometimes." The festival’s investigation revealed that unauthorized access may have compromised customer data, including names, email addresses, phone numbers, and residential addresses. However, Ferve does not store full credit card details, and no account passwords were exposed. MIFF acted swiftly to contain the breach, suspending access to affected accounts and implementing additional security measures. The Australian Cyber Security Centre (ACSC) has been notified, and the investigation into the breach’s origin remains ongoing. Ferve, an Australian-owned ticketing platform, serves multiple major festivals, including the Sydney Film Festival, Sydney Fringe Festival, and Melbourne Writers Festival. This year’s MIFF is scheduled to run from August 6 to 23 in Melbourne. Ferve has yet to comment publicly on the incident.