Australia Post incident
On 24 July 2025, Burnet Institute was contacted by Australia Post to inform us that our GPO Box 2284 at the Bourke Street Melbourne postal facility may have been compromised during the period from 6 July 2025 to 17 July 2025.
This means any letters containing donors’ personal information or paper-based donations mailed to the Institute from 1 July 2025 to 17 July 2025 (the relevant period) may have been stolen or unlawfully accessed.
While we believe that most of our donors won’t be impacted, it is not possible to know who mailed letters or paper-based donations to the Institute during this time.
We are doing all we can to identify those who may have been affected, including writing to donors who received our recent end-of-financial-year fundraising appeal about the HIV epidemic in the Pacific, to update them on this situation and provide advice on how to protect their personal and financial information.
We have also set up a dedicated phone line — (03) 9282 2189 — and email address — dataquery@burnet.edu.au — to answer any questions or provide support to donors.
If donors are concerned that their letter or donation may have been impacted, please call our dedicated team who will confirm if we have received your correspondence.
It is important to note that the Institute’s own systems have not been impacted in any way by the incident.
We are extremely disappointed by this incident and are continuing to engage with Australia Post to understand what has happened and what is being done to prevent something like this from happening again.
Our priority is providing support to donors and key stakeholders who may have been affected.
We have been advised by Australia Post that 4 break-ins occurred, isolated to the mezzanine area of the Melbourne GPO Box Room, after hours on:
- Sunday 6 July 2025
- Friday 11 July 2025
- Wednesday 16 July 2025
- Thursday 17 July 2025.
This means any letters or paper-based donations mailed to the Institute at our GPO Box 2284 from 1 July 2025 to 17 July 2025 may have been stolen and/or personal information contained in them unlawfully accessed.
Any letters containing donors’ personal private information and/or paper-based donations mailed to the Institute from 1 July 2025 to 17 July 2025 may have been stolen or unlawfully accessed.
It is not possible to be certain what, if any, correspondence has been impacted, but we believe that some letters containing donors’ personal private information and/or paper-based donations mailed to the Institute from 1 July 2025 to 17 July 2025 may have been stolen or unlawfully accessed.
The personal private information stolen or unlawfully accessed could include:
- full name
- address
- credit card details – if provided
- cheque details – if you sent us a cheque.
Donors who updated their personal contact details such as email address, mobile/phone number or dates of birth on the paper-based donation form should also note that this information may have been stolen or unlawfully accessed.
If you did not mail a letter or paper-based donation to us from 1 July 2025 to 17 July 2025 you have not been impacted, and no action is required.
If you did mail a letter or paper-based donation to us from 1 July 2025 to 17 July 2025 you may have been impacted. We encourage you to please contact our dedicated team on (03) 9282 2189 or email us at dataquery@burnet.edu.au. We will help confirm if we have received your letter or paper-based donation and advise on next steps.
We would also recommend you monitor your bank records for any suspicious activity and to be alert for any suspicious emails, calls or messages claiming to be from the Institute. Do not share personal or financial information unless you are sure of the source of the request.
If you notice anything unusual, please contact our dedicated team immediately.
Additionally, if you provided credit card details in your correspondence and we confirm that we did not receive your donation, you may wish to contact your bank and put a hold on or cancel your card if possible.
If this is not possible, we would recommend monitoring your credit card statements for any unusual activity.
If you mailed a cheque to us during this time, and we confirm we did not receive your donation, we would also recommend contacting your bank to cancel this transaction.
If you are not sure if your letter or paper-based donation is one of those impacted, please contact our dedicated support team at Burnet on (03) 9282 2189 or email us at dataquery@burnet.edu.au.
This incident may have affected donors and key stakeholders who mailed letters or paper-based donations to the Institute from 1 July 2025 to 17 July 2025 only.
This is because mailboxes at Australian Post’s GPO facility at Bourke Street Melbourne, were compromised during the period 6 July 2025 to 17 July 2025.
The Institute’s own systems have not been impacted by this incident.
We remain committed to protecting the privacy and security of all information entrusted to the Institute and are treating the issue with the highest priority and urgency.
The Institute’s Privacy Policy, including how we keep your information safe, is available on our website.
If you have already received a receipt from us, this means that we received your generous donation, and as such your mail and personal information have not been impacted by this incident.
If you are at all concerned, please contact our dedicated support team on (03) 9282 2189 or email us at dataquery@burnet.edu.au.
While it is not possible to know exactly who may have sent us letters or paper-based donations during the period from 1 July 2025 to 17 July 2025, we are proactively contacting all donors who received our end-of-financial-year fundraising appeal during this time.
If you have not heard from us, this means we do not believe you are affected by this incident.
If you are concerned or have any questions, please contact our dedicated support team on (03) 9282 2189 or email us at dataquery@burnet.edu.au.
We are extremely disappointed that this incident has occurred and are doing all we can to support donors and other key stakeholders who may have been affected.
We are also continuing to engage with Australia Post to try to understand the cause of the incident and what steps it is taking to prevent such an issue from occurring again.
None of the Institute’s own systems have been affected in any way by this incident.
This incident is as a result of Australia Post’s Bourke Street facility being compromised.