Identity Theft Response for Melbourne Families: A Structured Plan When a Data Breach Exposes Your Household
You get the email at 9pm — a company you barely remember signing up to has been breached, and your name, date of birth, driver licence number, and address are in the disclosed dataset. Your partner is on the same email. Your teenager used that service too. Your mum, who lives with you, is asking what she should do because her details were in there from when you booked something on her behalf. Nobody has stolen money yet, but the clock has started, and the question is what to do tonight, what to do this week, and what to keep watching for the next twelve months. Identity Theft Response from Cyber by Exegesis is the engagement that walks a Melbourne family through that sequence, calmly and in order.
The problem
When a breach notification lands, most families do one of two things: nothing, because the steps are unclear and the panic fades after a week, or everything at once, badly — calling banks in the wrong order, locking accounts they then cannot recover, missing the credit-file flag step entirely. The OAIC’s Notifiable Data Breaches scheme means in-scope organisations must tell you when your personal information has been disclosed, but the scheme tells you that it happened, not what to do next. The ACSC’s guidance for individuals and families covers the foundations — account recovery, MFA, password hygiene — and IDCARE is the national identity and cyber support service that issues credit-file flags and case-manages identity compromise. The work is knowing which lever to pull, in what order, for which family member.
The cross-generational shape of a household makes it harder. A breach that touches one parent’s email often touches the shared streaming accounts, the kid’s school portal login (because it reuses a family password), and the elderly relative whose details sit in your contacts and forms. ACCC Scamwatch consistently warns that breached personal data feeds directly into the next wave of targeted scams — impersonation calls referencing real details, “your account has been compromised” texts, recruitment scams that quote your real address. The breach is the opening move; the scam is the follow-up.
What Identity Theft Response does
Cyber by Exegesis runs a fixed-scope engagement designed for a single household affected by one or more breaches:
- A breach-scope mapping for every person in the household — what was disclosed for whom, drawn from the notification(s) you received, and what each disclosure type enables an attacker to do.
- Credit-file flag sequencing via IDCARE, with the call prepared and the supporting documents collated before you pick up the phone.
- ATO notification setup where tax file numbers or sufficient identity attributes were exposed, so that fraudulent return-lodgement attempts are flagged.
- Bank and card fraud reporting scripts for each financial institution your household uses, in the right order so that account locks do not strand you.
- Account-recovery sequencing for email, then identity providers (Apple, Google, Microsoft), then downstream services — because recovering the wrong account first lets an attacker keep the foothold.
- Ongoing monitoring setup: credit monitoring enrolment, Have I Been Pwned monitoring per family member, and a 90-day check-in for scam-call patterns matching the disclosed data.
Cyber by Exegesis is the cyber consultancy line of Exegesis — the same company behind the DRMO live product. This engagement is response, not prevention. We work through the breach as it is, with the people in your household as they are.
How it works
- We confirm the engagement scope on a short call, list every household member in scope, and ask you to forward the breach notification(s).
- We produce a one-page exposure map per person — what was disclosed, what it enables, and which steps apply to them.
- We sequence the response: IDCARE first where credit-file flags are warranted, then ATO, then banks, then account recovery, then monitoring.
- We sit with you on a call (typically 60–75 minutes) and work through each step live — phone calls placed, recovery flows completed, MFA re-enrolled.
- We leave you with a written record of what was done, what is being monitored, and a 90-day review to revisit any scam contact you have received in the meantime.
Why this matters in Melbourne
Melbourne households are over-represented in the kind of subscription, healthcare, and education services that have featured in large Australian breach disclosures over recent years. A single Melbourne family typically touches health funds, schools, universities, super funds, and state government services — each one an in-scope entity under the OAIC NDB scheme, each one capable of generating a notification. The compounding effect is real: a household that sees two or three breach notifications in a year ends up with enough of its personal data in circulation that targeted impersonation scams become statistically likely. ACCC Scamwatch’s guidance on identifying scams is the right reference, but the response work is what closes the loop.
Sources
- ACSC guidance for individuals and families: https://www.cyber.gov.au/protect-yourself
- OAIC Notifiable Data Breaches scheme: https://www.oaic.gov.au/privacy/notifiable-data-breaches
- ACCC Scamwatch (National Anti-Scam Centre): https://www.scamwatch.gov.au/
- eSafety Commissioner (for related online-safety reporting, including impersonation affecting minors): https://www.esafety.gov.au/
- Cyber by Exegesis — Identity Theft Response (waitlist)
Join the waitlist
We are sequencing engagements by household size and by the type of breach notification received. Join the waitlist with a brief note on how many people are in your household and which breach(es) prompted you to look — we will tell you when we are ready to take a brief from your family.