No1 isn’t suggesting whether it’s criminal or not. I am concerned about Medicare’s security as well as the criminal behavior of OpenAI. There’s multiple lines of inquiry here, including;

1. How did OpenAI do this? What are we charging them with? How big will the penalty be to deter this in the future? (Ha ha. I can dream.)

2. How did Medicare/ASD not know about this until they received an email from the attacker 3 months later? What policies/procedures need to change? What can we do to shrink the attack surface and increase detection?

I initially thought you meant discrimination between rich and poor, but “grab money from everyone” still discriminates against people that can’t afford the visa/passport.

Citizens have rights and eligibilities that non-citizens don’t. That’s not discrimination that needs to be addressed; it’s national sovereignty. Non-citizens aren’t eligible for HECS, aren’t eligible to vote, aren’t eligible for a passport, and aren’t eligible for federal jobs. Non-citizens aren’t eligible for these because they are not Australian.

Live here and choose to become an Australian, or live here and choose to not become an Australian. Choose the latter and you’ll need a visa.

For the record; I think the Returning Resident visa fee is exorbitant. I also think the suggestion that Australians should pay more so it’s fair for non-Australians is ridiculous.

• Australia allows dual citizenship
• Republic of Korea requires you to relinquish your Korean citizenship if you become a citizen of another country
• Girl with ‘no options’ chooses to keep her Republic of Korea citizenship
• Australia imposes visa fees that apply to non-citizens of Australia
• You suggest Australian’s that are born here, or choose to become citizens here, pay more to make it fair

Walk me through this logic? Why should people that choose to join (or are born in) Australian citizenry pay more to make it fair for a limitation of RoK citizenship?

Let’s discuss whether the visa fee is too high, for sure. But suggesting a penalty for Australian citizens to “not discriminate” against someone that has chosen not to become a citizen is absolutely ludicrous to me.

Getting them out of government would be a good start.

https://www.abc.net.au/news/2024-02-09/coles-just-hired-us-defence-contractor-palantir/103443504

If the petition goes somewhere, it would be great to see a general ban on them operating in Australia. Of course, this is a far shot dream with a bunch of ramifications… but one can dream.

If your house plumbing is leaking there is water going out where it shouldn’t be.

Yes. Correct. Personally Identifiable Information openly exposed on the internet is information going out where it shouldn’t be.

If your house is leaking, whether there’s someone out there with a cup doesn’t change whether your house is leaking or not. It only changes whether someone took your water ie. a breach

Data leak and data breach have specific definitions:

Data Leak vs Data Breach: What Is the Difference? While many use the terms “data leak” and “data breach” interchangeably, there is a difference between the two. A data leak often comes from within the organization either by accident or intent, while a data breach occurs when confidential or otherwise protected information is accessed, stolen, or used by outsiders without authorization. https://www.fortinet.com/resources/cyberglossary/data-leak

https://www.microsoft.com/en-us/security/business/security-101/what-is-a-data-leak

https://www.oaic.gov.au/privacy/your-privacy-rights/data-breaches/what-is-a-data-breach

https://www.ibm.com/think/topics/data-leakage

https://www.trendmicro.com/en/what-is/data-breach/data-leak.html

This is a data leak. We don’t know yet if it’s a data breach. We might not know until active exploitation.

Given the lack of control on this data, and that it wasn’t fixed until the researchers told them about it, do you trust IDMerit to have the scrutiny on their logging to know if it was accessed externally? I don’t.

If your house plumbing is leaking, its not a leak to you unless you see it? How do you know it hasn’t been accessed?

Thankfully we don’t need to rely on your definition of a data leak: https://www.fortinet.com/resources/cyberglossary/data-leak

A data leak happens when an internal party or source exposes sensitive data, usually unintentionally or by accident.

This is sensitive data that’s accidentally been exposed on the internet. That is a leak. You are misinformed on what a data leak is.

It’s not misleading. A database of personally identifiable information being exposed on the internet is a data leak. Personally identifiable information is legally required to be protected, while an exposed database on the internet is about as far from ‘protected’ as you can get.

The article and title make no claim to active selling or known exploitation of the data, but to write this off as nothing would be a mistake. Are you sure that only the Cybernews team found it?

The Cybernews team discovered the exposed MongoDB instance on November 11th, 2025 and immediately notified IDMerit. The company secured the database by November 12th.

We don’t know how long it was exposed for prior to it being discovered on the 11th - it might’ve been that day, it might’ve been a few months.

Oh my god, I totally missed that. Amazing lol Thanks for that!

Would you mind elaborating on why this is your favourite? I tried to find some context for it but all I can really seem to find is the quote itself.