Suspected data breach: a mortgage support handoff card

Give mortgage support staff a short route for a suspected data breach: use the approved immediate response, contact the designated incident owner, record what is known and obtain an accepted handoff. The worker should be able to raise an uncertain event without first proving the full extent of exposure.

This guide offers an initial incident card and a fictional mortgage-file exercise for Australian brokerages. Use them within your existing response plan. The brokerage's responsible privacy, technical and legal advisers determine the investigation and any notification obligations.

Make the first response usable before assigning live files

The OAIC's response-plan guidance recommends written responsibilities, clear immediate contacts and regular testing, including hypothetical breaches. It also recommends a second contact for response-team roles. Turn the approved plan into a role-specific instruction that a remote assistant can find quickly.

Show the worker the primary contact, backup, approved communication channels and instructions for an unavailable or suspect account. A contact list stored only inside the system involved in an incident is a dependency to resolve during preparation. Agree an approved way to reach help without that system.

Ask the system and incident owners to identify any immediate actions the worker is authorised and trained to take. Record those actions exactly. An assistant who notices an unexpected sharing link needs clear instructions; they should not have to improvise changes to accounts, devices or evidence.

Use an incident card that separates observation from uncertainty

Initial mortgage-support incident handoff

Field	What to record	Example of an uncertainty to preserve
Discovery	When, in which time zone, and how the issue was noticed	Actual start time of exposure unknown
Observed event	A factual description and controlled reference to the source	External access has not been established
Potentially involved material	Relevant file references and apparent document types	Whether other files were reachable is unknown
Immediate response	Approved action taken, by whom and when	Outcome of attempted access restriction unconfirmed
Evidence location	Where the original message, event or log can be examined	Technical owner has not yet reviewed the log
Accepted owner	Who acknowledged the incident and their next instruction	Message sent; no acknowledgement yet
Affected work	Preparation or communications requiring an owner's decision	Whether a planned send may proceed is unresolved

Use controlled references instead of pasting a client's payslip, bank statement or identity document into a broad team message. The incident owner can direct how relevant material is preserved and shared. Keep the initial card concise enough to act on, then add later facts with their own times.

Write “link found with unexpected sharing settings; access history not checked” when that is all the worker knows. “Customer data stolen” and “nothing was accessed” both assert more than that observation establishes. Preserve the uncertainty so the responsible people can investigate it.

Keep urgent containment and evidence preservation connected

The OAIC advises immediate action to limit a suspected breach and cautions against destroying evidence during the preliminary response. Use the organisation's approved response rather than deleting the record to make an alert disappear.

If the worker has already taken an approved action, record its actual result. “Requested removal of the link” is different from confirmation that the system owner removed it. Keep attempts and confirmed changes as separate events. Escalate an unavailable owner through the approved backup route rather than assuming a sent message has transferred responsibility.

For an outsourced team, make the brokerage contact and provider contact visible in the same response instructions. Identify who coordinates the incident. The worker's first report should reach that owner through the agreed route, with the provider's relevant observations linked rather than scattered across separate chat threads.

Rehearse a fictional misdirected document message

In this illustrative exercise, an assistant preparing an income-document pack notices that a message was addressed to the wrong recipient. The mock message includes a link. The assistant cannot tell from the sent folder whether anyone opened it or what access that recipient had.

The fictional pack contains separate payslips for two applicants and an accountant's covering message. The initial card could read: “09:10 AEDT: incorrect recipient noticed in mock message sent at 09:02. Possible material: applicant A payslip, applicant B payslip and accountant cover, using the mock record references. External access unknown. Broker-review pack due at 11:00; incident owner's instruction needed on continuing that task. Primary contact notified; acknowledgement pending.” These times are exercise inputs, not response targets.

The assistant uses the approved immediate response, contacts the incident owner and records the message reference, intended and actual recipient references, discovery time and apparent document types. They state that access and wider scope are unknown. They follow instructions for preserving the original event and record any containment action separately.

The exercise facilitator then says the primary contact is unavailable. The worker should locate the backup and obtain acknowledgement. Next, the facilitator supplies a fictional system-owner response: the link has been restricted, but access-log examination remains open. The worker updates those two states accurately.

Finish by asking who owns the next update and whether the planned broker-review pack is affected. The purpose is to test recognition, communication and accepted ownership. It does not establish a breach classification, prove technical containment or simulate a complete investigation.

Reserve assessment and external communications for the response owner

The OAIC's current quick reference guide separates containment, assessment, notification where required, and review. It explains that the NDB notification decision depends on the scheme's applicable criteria. A support worker's completed incident card is information for that process, rather than a finding that every event is reportable.

Give the assistant approved wording for routing incoming questions to the response owner. The owner decides what can be said, by whom and through which channel. Keep any customer communication instruction attached to the incident record so a routine application-status template is not used accidentally.

Record a closure instruction only when the designated owner provides it. A restored link, acknowledged message or resumed file task may close one operational action while the wider incident remains open. Use separate states for the support task and incident owner's review.

Assess the support role through a rehearsal

Before expanding access, ask the worker to find the current contacts, explain their immediate actions, complete the fictional incident card and handle the unavailable-contact variation. Review accuracy and escalation judgement without rewarding a quick unsupported declaration that the matter is safe.

The access permissions matrix helps define everyday access. The business continuity guide covers operating disruption and recovery. Add this incident handoff where the immediate problem is uncertain exposure of customer information.

Discuss mortgage support responsibilities with Mortgage Talent. Bring the approved incident route and the administrative duties the person will own, alongside the technical and privacy decisions assigned elsewhere.