You Can't See the Threat at the Door — The OutABox Breach Explained

In 2024 an Australian IT provider called OutABox suffered a data breach. The company ran the digital sign-in systems at the front doors of NSW pubs, clubs, and hospitality venues. More than one million patron records were exposed, and identity-check information (including biometric data in some cases) was implicated across more than a dozen NSW venues. It's the single clearest example of the problem we keep coming back to: modern threats don't stay on one side of the wall, and a vulnerability you can't see is just as dangerous as the one you can.

What actually happened

Licensed venues in NSW are legally required to capture patron information on entry. That makes the sign-in process a mandatory, daily, high-trust point of contact with your guests. OutABox built and operated exactly that system. When the breach became public, the NSW data-protection regulator [ID Support NSW] confirmed that at least 14 venues were implicated — Merivale venues were named among the group widely reported as affected. The provider said the incident was attributed to an "unauthorised third party." A leak-check site (haveibeenoutaboxed.com) was later published so people could search the exposed data. The exact figures reported vary. Some outlets put the number at over one million records and described the scale as "more than one million Australian ID records." The fallout was severe enough for the ABC, ClubsNSW, and the regulator to respond publicly.

Why this matters for your venue

A physical-entry system carried digital risk. The sign-in kiosk at the door looked like the most mundane part of the operation. In fact it was quietly collecting some of the most sensitive data your venue handles: names, addresses, dates of birth, ID numbers, and in some cases biometric information. This is exactly the gap an independent, physical-and-digital assessment exists to close:

The vendor is the risk. Your venue likely runs dozens of third-party systems: sign-in, access control, payment, cloud cameras. Each one holds data you're legally responsible for protecting, even though you don't manage the servers.
Compliance sits with you. Under Australian privacy and data-protection law, the venue is accountable for how the personal information it collects is stored and secured, regardless of which vendor provided the system. "They handle the IT" does not transfer that responsibility.
The threat crossed from physical to digital. Someone walked in through a front-door process and left with more than a million identities.

Three checks worth doing today

Check the vendors holding patron data. Make a list of every third-party system that collects personal information: sign-in, door access, bookings, payments, CCTV retention. Write down who hosts the data and where. If you can't complete this list from memory, that's your first finding. Ask the data-breach question. For each vendor, ask: What is your incident-response and breach-notification process, and how fast am I told? A contract clause that gives you notice within 72 hours is worth more than a slick sales deck. Understand your legal exposure. Confirm who is accountable for that data in your venue. If you're not sure, that uncertainty is itself a risk worth resolving before an incident, not after.

The honest takeaway

There is no security layer you can set and forget. The most dangerous system in your venue is usually the one nobody has assessed. An independent, external perspective that looks at physical and digital, and holds vendors to account, is how you find the gap before someone else does. Honour Guard is an independent Sydney security consultancy. We don't sell products or vendor solutions. We give you an objective picture of your real exposure, physical and digital.

Sources & further reading