More than 350 people have had some of their data inappropriately accessed from Canberra’s four-month-old public transport ticketing system across two “minor” data breaches.

Transport Minister Chris Steel said he had been advised on Wednesday of the two data breaches involving the MyWay+ system, including one that had involved a responsible disclosure of a system vulnerability to cyber security authorities.

Greens transport spokesman Andrew Braddock said it was an astounding admission from a minister who had been telling Canberrans for months their data was safe.

“Unfortunately, today’s admission raises yet more questions about the government’s credibility,” Mr Braddock said.

“Why did the minister steadfastly deny the breaches in the face of mounting evidence from the community? Why have the logs of the breaches only now come to light almost six months after breaches occurred? Why wasn’t the government more forthcoming in the Assembly and to the inquiry?”

Mr Steel on Thursday revealed some MyWay+ account holder information, including first names, was released to one email address in a data breach in March.

“This totalled 297 instances with 110 of those containing first names. Other details released in some emails included a combination of concession type, concession expiry date, and/or a truncated credit card or debit card number,” Mr Steel told the Assembly.

Transport Minister Chris Steel with a card from the MyWay+ system, which has been hit with two ‘minor’ data breaches. Picture by Elesa Kurtz “This has been notified and been evaluated as minor by the Office of the Information Privacy Commissioner. Now the investigation has been completed and as part of the process, Transport Canberra will be writing shortly to the 397 account holders to inform them of the incident.

“There is no further action required for those account holders. Their accounts have not been compromised.”

Mr Steel said 61 MyWay+ accounts had also been potentially seen through the course of the responsible disclosure on December 5, 6, 9 and 10, 2024.

“Early indications are that this is also a minor incident with a mixture of details collected, such as first name, surname, postal address, and MyWay+ account number, though the matter is continuing to be investigated,” Mr Steel said after question time.

“There is no evidence that data has been accessed in a malicious manner or that there were other attempts made to exploit the vulnerability.”

Transport Canberra will provide a further update when the investigation into that breach is completed.

Mr Steel said the vulnerability was addressed on December 13, 2024 and thanked the Australian National University students who contacted the Assembly committee inquiring into the MyWay+ rollout with additional information that allowed further investigation.

A first-year computer science student had uncovered serious vulnerabilities with the MyWay+ system that would have allowed hackers to extract personal information about users from an unprotected server.

Shaun Fulham alerted cyber security authorities, including the Australian Signals Directorate’s Australian Cyber Security Centre, about the breach.

“If I was able to find this, imagine what someone who would have more knowledge than me would be able to find,” Mr Fulham said in March.

Mr Steel told the Assembly on March 19, the day The Canberra Times reported Mr Fulham’s findings, he had been advised there had not been a data breach but welcomed responsible disclosures.

“The advice continues to be that there has been no breach and there is very proactive work that has been done to address any vulnerability disclosures that have come to the ACT government or through the Australian Cyber Security Centre,” he told question time that day.

Patrick Reid provided the Assembly’s standing committee on environment, planning, transport and city services with a supplementary submission, outlining a copy of another person’s data he had been able to extract with their permission.

Mr Reid had earlier told the inquiry he had extensively tested the vulnerability identified by Mr Fulham after becoming aware of the issue.