Cybersecurity Incident: Productivity Commission Email Spoofing Under Investigation On 9 June 2026, Australian media outlets, including Cyber Daily, received unusual emails from the Productivity Commission’s automated noreply address (`[email protected]`). The messages contained bizarre content such as the subject line “:(” and the phrase “cybercriminals are not terrorists” alongside offensive language and a link to a threat actor forum associated with the hacking group 2019. Some emails included personalized details, such as the recipient’s name, suggesting a targeted approach. The Productivity Commission confirmed the incident the following day, revealing that an external third party had exploited a previously undetected vulnerability in its website to send the emails. While the sender implied access to internal records, the Commission stated that no evidence indicated a breach of its systems or exposure of stored personal data. Many affected individuals had no prior engagement with the agency. The vulnerability was patched, and the incident was reported to the Australian Cyber Security Centre (ACSC). The Commission has since implemented measures to prevent further misuse of its email systems. Notably, threat actor 2019 linked to the forum reference has not claimed responsibility or publicly acknowledged the incident, leaving its motives unclear.