Australia's corporate regulator failed to alert other government agencies about concerns that transcription provider VIQ Solutions had potentially sent sensitive data offshore, internal emails released under freedom of information laws reveal, despite being asked by the Australian Tax Office to assess whether other departments had been affected.
The emails, exchanged between the Australian Securities and Investment Commission (ASIC) and the ATO, show alarm was first raised around March 2025 when VIQ sent the tax office an email containing a hyperlink to a transcript "available for download" from a site in the United Kingdom. Sensitive data from courts and federal government agencies is forbidden from being stored or processed offshore due to potential hacking and national security risks.
An assistant director at the ATO wrote to both ASIC and VIQ: "This appears to indicate the [sic] VIQ Solutions is already allowing customer data to be shared, accessed or used outside of Australia. This is of serious concern to the Australian Taxation Office."
Both agencies advised staff to stop using VIQ for transcription services until they had more information. An ASIC project coordinator wrote in an email chain including ATO staff that they had requested VIQ conduct an investigation and confirm data had not been sent overseas. "If you haven't already, you may wish to request that a similar investigation is also completed for the ATO," the coordinator wrote.
In the days that followed, an ATO director raised concerns about the integrity of VIQ's response, writing: "We have found some potential inconsistencies in VIQ response to date and more impacts the more questions we ask."
By early May 2025, VIQ had provided a report to ASIC, which determined the incident was a "near miss" and that none of its own data had been compromised. An ASIC staff member responded to an ATO query about broader impact by saying this would be discussed after its own investigation. The emails do not show whether that assessment was carried out.
The concerns arose approximately one year before the ABC revealed family court and Federal Court data had been sent offshore by VIQ Solutions. Shortly after that breach became public, VIQ was put into administration and eventually shut down. At least 13 government agencies used VIQ before ASIC removed the company as an approved supplier from AusTender on March 19, 2026.
The ATO told the ABC it "reported the incident to the relevant panel manager". ASIC said it had taken "appropriate action" and that "VIQ was responsible for notifying agencies affected under any separate arrangements".
Shadow Attorney General Senator Michaelia Cash said the growing concerns needed investigating. "It's astounding this issue continues to grow but the Attorney General keeps her head in the sand," Senator Cash said. "The Coalition has called for an investigation co-ordinated by the Attorney General that stretches across all government agencies."
An administrators' report from McGrath Nicol, which stepped in when VIQ entered voluntary administration, found the data breach "adversely affected" the company's ability to secure tender opportunities and that directors may have breached their duties by "not acting with care and diligence". Investigations into the court data breach are ongoing.
Analysis
Why This Matters
- Sensitive government and court data was potentially accessible from offshore servers, raising national security risks that the agencies responsible for managing the transcription panel failed to address for almost a year
- The incident reveals gaps in how government watchdogs handle potential data breaches at shared suppliers, with no independent cross-agency investigation conducted despite an explicit request from the ATO
- At least 13 federal agencies used VIQ Solutions, meaning other departments may have had data exposed without being notified
Background
VIQ Solutions was a preferred government transcription provider used by courts and federal agencies to convert audio recordings into text. Australian government policy forbids sensitive data from being stored or processed offshore. Concerns about VIQ's practices emerged in March 2025 when an ATO staff member received a hyperlink pointing to a server in the United Kingdom. The company was later removed from the government's approved supplier list and entered voluntary administration after the ABC reported that court data had been sent offshore. An administrators' report found directors may have breached their duties.
Key Perspectives
ASIC: said it had taken "appropriate action" and that VIQ was responsible for notifying affected agencies under separate arrangements. It determined the 2025 incident was a "near miss" based on VIQ's own report.
ATO: reported the incident to the panel manager and ceased using VIQ pending investigation. An ATO director raised concerns about "potential inconsistencies" in VIQ's responses.
Shadow Attorney General Michaelia Cash (Coalition): called the growing concerns "astounding" and reiterated the Coalition's call for a co-ordinated investigation across all government agencies.
McGrath Nicol administrators: found the data breach "adversely affected" VIQ's ability to win tenders and that directors may have breached their duties by "not acting with care and diligence".
What to Watch
- Whether the Attorney General responds to calls for a cross-agency investigation into the VIQ offshoring of government data
- The outcome of ongoing investigations into the court data breach that prompted VIQ's collapse
- Whether any other government agencies come forward to report that their data was also affected
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedASIC ignored the ATO’s request to assess whether other agencies had been affected and left the matter to VIQ.Just In: “The emails also show that ASIC, which was responsible for managing the relationship between VIQ as a preferred provider and government agencies, ignored an ATO request to assess whether other agencies had been impacted and instead left it up to VIQ.”
- SupportedASIC determined the incident was a “near miss” without an independent investigation into other agencies using VIQ.Just In: “Based on the report, ASIC determined the incident was a "near miss" and that none of its own data had been compromised. But there was no independent investigation into any other agency using the service.”
- SupportedThe emails show ASIC failed to alert other government agencies about concerns that VIQ had potentially sent sensitive work offshore.Just In: “Australia's corporate watchdog failed to alert other government agencies about concerns that transcription service VIQ Solutions had sent potentially sensitive work offshore, documents released under Freedom of Information (FOI) have revealed.”
- SupportedAn ATO assistant director wrote that VIQ appeared to be allowing customer data to be shared, accessed or used outside Australia and that this was of serious concern to the ATO.Just In: “"This appears to indicate the [sic] VIQ Solutions is already allowing customer data to be shared, accessed or used outside of Australia. This is of serious concern to the Australian Taxation Office."”
- SupportedASIC and the ATO advised staff to stop using VIQ for transcription until they had more information.Just In: “The ATO and ASIC advised staff to stop using VIQ for transcription services until they had more information.”
- SupportedAn ASIC project coordinator wrote, “If you haven't already, you may wish to request that a similar investigation is also completed for the ATO.”Just In: “"If you haven't already, you may wish to request that a similar investigation is also completed for the ATO," the project coordinator wrote.”
- SupportedAn ATO director wrote that the ATO had found potential inconsistencies in VIQ’s response and more impacts as it asked more questions.Just In: “"We have found some potential inconsistencies in VIQ response to date and more impacts the more questions we ask," an ATO director wrote.”
- SupportedAn ASIC staff member said broader impacts would be discussed after ASIC’s own investigation, and the emails do not show whether that assessment occurred.Just In: “An ASIC staff member responded saying this would be discussed after its own investigation. The emails do not show whether this was carried out.”
- SupportedThe concerns arose approximately one year before the ABC revealed family court and Federal Court data had been sent offshore by VIQ.Just In: “The concerns about the integrity of ATO and ASIC data, occurred approximately one year prior to the ABC revealing family court and Federal Court data was sent offshore by VIQ Solutions.”
- SupportedAt least 13 government agencies used VIQ before ASIC removed it as an approved AusTender supplier on March 19, 2026.Just In: “At least 13 government agencies used VIQ Solutions before ASIC removed the company as an approved supplier from AusTender on March 19, 2026.”
- SupportedThe ATO told the ABC it “reported the incident to the relevant panel manager.”Just In: “The ATO said it "reported the incident to the relevant panel manager"”
- SupportedSenator Michaelia Cash said, “It's astounding this issue continues to grow but the Attorney General keeps her head in the sand.”Just In: “"It’s astounding this issue continues to grow but the Attorney General keeps her head in the sand," Senator Cash said.”