November 2026 Third Party Security Incident

What exactly happened, and when?

We identified unauthorised access to a system we use to manage customer support enquiries, and found that some customer information had been accessed and downloaded by an unauthorised party. We shut down that access, are investigating, and are working to strengthen our security.

When did you find out?

We identified the unauthorised access on 10 November and closed it off the same day. We then worked quickly to confirm what information was involved, so we could let the people affected know.

Has the breach been contained, or is my data still at risk?

Yes, the access has been closed off and we're working to strengthen our security. The main thing to watch for now is scam messages and websites pretending to be Airtasker. Because some personal information was taken, these scams could feel personal and genuine, and they’re getting harder to spot. 

We’ll never ask for your bank details, card number or password by email, text, phone or link. If you’re unsure, go directly to the Airtasker app or airtasker.com.

How many customers are affected?

We're contacting everyone affected directly. If you haven't received an email from us, your information wasn't involved. 

What information of mine was exposed? 

For most people, this was contact details such as name, email address and phone number, plus details from support enquiries they'd sent us. The email we sent you explains what was involved for you.

Why did you have my driver's licence, ID or card details on a support ticket at all?

Sometimes customers share documents with our support team, for example to verify their identity or sort out an issue. We never ask for card numbers, but occasionally they're included in a message.

What are you doing to protect the information I might share in the future?

Our team removes sensitive details when they see them, and we've now enabled automatic removal of card numbers to provide greater security. 

Why were you keeping this data, and for how long? 

We keep support records for a set period so we can help with ongoing issues and meet our legal obligations, after which they're deleted. 

Was my data actually accessed or stolen, or just potentially exposed? 

Based on our investigation, some of your information was accessed and is likely to have been downloaded, so it’s safest to assume it was taken. That’s why we’ve let you know. We’ve closed off the access and are putting further protections in place.

Was the full card number exposed, or only part of it? Was the CVV included?

Card details stored in your Airtasker account weren't involved. In a very small number of cases, a customer had typed card details into a support message themselves. Anyone this applies to has been contacted directly.

Can you send me a copy of the tickets or data that were exposed?

All users on our platform have the right to access their information we hold. To access your information, please follow our process by clicking this link. 

Was any other information exposed, such as messages, task details or payment history?

The information came from our customer support system and included contact details and details from support enquiries. For some customers, it also included basic account activity, like the number of tasks posted or completed. Payment details stored in your Airtasker account weren’t involved.
This information could be used to make scam messages feel more personal and convincing, so please stay alert to any unexpected emails, texts or calls. 

Should I cancel my credit card?

Card details stored in your Airtasker account weren't involved. If you ever included card details in a message to our support team, it's a good idea to let your bank or card issuer know so they can keep an eye on your account.

Do I need to replace my driver's licence or passport?

Each type of ID has different recommendations depending on the agency that issued it. If your email from us says an ID document was involved, we recommend you contact the issuing authority.

Should I change my Airtasker password, or passwords elsewhere?

For most people, their Airtasker password wasn’t involved. However, a small number of people shared a password in a support message, and we’ve emailed to notify them.  If you’ve ever shared a password with our support team, please change it now, along with anywhere else you’ve used it.

As a good habit, we recommend using a unique password for each account and turning on two-step verification for your email.

How do I know if someone is using my identity?

Look out for unexpected bills, accounts or messages you don't recognise. For more information, visit Identity fraud | OAIC. 

Could someone use my ID to impersonate me on the platform?

Airtasker accounts were not generally accessed. We have checks in place to protect accounts, and if you notice anything unusual, let us know through 'Contact us' in the app and we'll look into it straight away.

What scams should I watch out for?

Watch for emails, texts or calls claiming to be from Airtasker, especially ones that say a payment is 'on hold', ask for your bank details, or ask you to sign in through a link. The unauthorised party took steps that suggest they were preparing a payment scam, such as fake Airtasker emails asking for bank details. 

Fake emails and websites can look exactly like ours, so always go to the Airtasker app or airtasker.com directly. If you see a website, email or message pretending to be Airtasker, please report it to our support team via trust@airtasker.com. 

How do I know this email is really from Airtasker and isn't phishing?

Our email doesn't ask you to click a link to sign in or share any details. If you're unsure, open the Airtasker app directly and contact us there. If you receive an unexpected call from Airtasker  - hang up, block the number and never give them any personal information. 

What are you doing to fix this and stop it happening again?

We've closed off the access and added extra protection to files shared with our support team. We're also reviewing our security and working to strengthen it further.

Are you deleting the old data from tickets?

We've now enabled automatic removal of card numbers from support messages, and we're reviewing older support records to remove sensitive information. 

Have you reported this to relevant government bodies or the police?

 Our first priority was our customers, and we’re in the process of notifying the relevant authorities, including the Office of the Australian Information Commissioner. If you receive a scam message pretending to be Airtasker, you can report it to Scamwatch at scamwatch.gov.au as well as to us at trust@airtasker.com.

Will I be told if you find out more?

Yes. If we learn anything new that affects you, we'll contact you directly. We won’t update you if there are no major updates that impact you.

I deleted my account years ago. Why do you still have my data?

We keep support records for a set period so we can help with ongoing issues and meet our legal obligations, after which they're deleted.