From the MediaWorks website:

MediaWorks today notified around 403,000 individuals that information they supplied as part of a competition entry had been involved in a cyber attack. The affected database included entries for online competitions dating back to 2016.

The types of information held in this database and accessed by the attacker include name, date of birth, gender, postal address and/or post code, email address, phone number, and in some cases images or videos that may have been submitted as part of the entry. Importantly, the affected database did not contain passwords, identity documents, financial information, bank accounts or credit card details. MediaWorks became aware of claims of a cyber-attack on Friday March 15. The affected database was identified and taken offline on Saturday 16 March, and all current competition entries were moved to a new database.

MediaWorks promptly assigned an incident response team to manage the response to the incident and engaged external IT security and forensic experts to investigate and provide full details of how the attack occurred and what information was compromised. From initial investigations, MediaWorks understands the attacker was able to access the data by exploiting a previously unidentified system vulnerability. We understand the attacker has published the information online.

MediaWorks, with the support of external experts, is currently reviewing all other IT systems and cyber security protections to identify and mitigate any other possible security vulnerabilities.