ATO and ASIC feared data was sent offshore in 2025, internal emails reveal

Australia's corporate watchdog failed to alert other government agencies about concerns that transcription service VIQ Solutions had sent potentially sensitive work offshore, documents released under Freedom of Information (FOI) have revealed.

Sensitive data from courts and federal government agencies is forbidden from being stored or processed offshore due to potential hacking and national security risks.

Internal emails between the Australian Securities and Investment Commission (ASIC) and the Australian Tax Office (ATO) exposed concerns that preferred government transcription provider, VIQ, had potentially offshored sensitive data, almost a year before the ABC first reported a court data breach by the same company.

The emails also show that ASIC, which was responsible for managing the relationship between VIQ as a preferred provider and government agencies, ignored an ATO request to assess whether other agencies had been impacted and instead left it up to VIQ.

The alarm was first raised around March 2025 when VIQ sent an email to the ATO that included a hyperlink to a transcript that was "available for download" from a site in the United Kingdom.

An assistant director at the ATO sent an email to both ASIC and VIQ stating:

"This appears to indicate the [sic] VIQ Solutions is already allowing customer data to be shared, accessed or used outside of Australia. This is of serious concern to the Australian Taxation Office."

The ATO and ASIC advised staff to stop using VIQ for transcription services until they had more information.

"We have requested that VIQ conduct an investigation and confirm that our data has not been sent overseas. We are also not utilising VIQ until the investigation is complete," an ASIC project coordinator wrote in an email chain that included ATO staff.

"If you haven't already, you may wish to request that a similar investigation is also completed for the ATO," the project coordinator wrote.

In the days that followed, concerns were raised about the integrity of the information being provided by VIQ in response to the potential breach.

"We have found some potential inconsistencies in VIQ response to date and more impacts the more questions we ask," an ATO director wrote.

By early May, VIQ had provided a report to ASIC about the potential breach. Based on the report, ASIC determined the incident was a "near miss" and that none of its own data had been compromised.

But there was no independent investigation into any other agency using the service.

An email from a project coordinator at ASIC on May 12, 2025 stated:

"Recently ASIC became aware of a potential data breach after Evidence Support Panel provider, VIQ, was thought to have sent ATO data processing offshore… This incident was determined to be a near miss, and we will work with VIQ to ensure that any risk mitigation and process improvements are implemented to ensure ongoing security."

The concerns about the integrity of ATO and ASIC data, occurred approximately one year prior to the ABC revealing family court and Federal Court data was sent offshore by VIQ Solutions.

Shortly after the court data breach became public, VIQ Solutions was put into administration and eventually shut down. Investigations into the court data breach are still ongoing.

Emails show that in March 2025 an ATO director raised whether other agencies might be affected and later questioned whether ASIC would assess any broader impact.

An ASIC staff member responded saying this would be discussed after its own investigation. The emails do not show whether this was carried out.

The ABC asked both the ATO and ASIC if either department raised the offshoring incident with any other government agencies who used VIQ at the time.

The ATO said it "reported the incident to the relevant panel manager", who is the person responsible for managing any potential breaches and assessing risks to the Commonwealth.

ASIC said it had taken "appropriate action" and that "VIQ was responsible for notifying agencies affected under any separate arrangements".

At least 13 government agencies used VIQ Solutions before ASIC removed the company as an approved supplier from AusTender on March 19, 2026.

Shadow Attorney General Senator Michaelia Cash said the growing concerns about data integrity needed investigating.

"It’s astounding this issue continues to grow but the Attorney General keeps her head in the sand," Senator Cash said.

"The Coalition has called for an investigation co-ordinated by the Attorney General that stretches across all government agencies. 

"This latest example only reinforces the need for such an investigation to assure Australians our national security has not been compromised."

In July, an administrators' report from McGrath Nicol — who stepped in when VIQ Solutions went into voluntary administration — found the data breach "adversely affected" the company's ability to secure tender opportunities.

The administrators also found that the directors of VIQ Solutions may have breached their duties by "not acting with care and diligence".