What is Cinema 3, and why was ACMI affected?

Cinema 3 is ACMI's online streaming and film-hire service. The unauthorised access happened on a third-party system used to run Cinema 3, rather than ACMI's core systems. This is a supply-chain (third-party) breach, where an incident at a vendor exposes the data of the organisation that relies on it.

How do I know if I was affected by the ACMI breach?

ACMI said all customers who have hired an online title through its Cinema 3 streaming service are affected. If you have rented a film through Cinema 3, you may be affected. You can also check your email address against known breaches using the free In The Event Of breach checker.

Is the claim of 25,000 affected customers confirmed?

Not fully. The 25,000 figure and the specific data fields (such as dates of birth and IP addresses) are the claims of a threat actor who published a dataset on a hacking forum. ACMI acknowledged the claims and confirmed some customer data was impacted, but said it had not verified the actor's specific figures at the time of writing.

Who is behind the breach?

A threat actor using the alias '2019', which has been linked to more than 20 claimed breaches on hacking forums since February 2026. The same actor claimed responsibility for the Melbourne International Film Festival (MIFF) breach around the same time.

What has ACMI done in response?

ACMI said its technology team contained the incident and secured the platform, and that a full system review found no further breaches. It notified the Australian Cyber Security Centre (ACSC) and worked with the Victorian Government Cyber Incident Response Service and the third-party provider to investigate.

Australian Centre for the Moving Image (ACMI) Data Breach 2026:
What You Need to Know

Q: Were my payment or password details exposed?

No. ACMI confirmed that payment card details and passwords were not compromised, because they are not stored in the affected system. The data involved relates to accounts on ACMI's Cinema 3 online film-hire service.

A threat actor claimed to have published data on more than 25,000 Australian Centre for the Moving Image (ACMI) customers, taken via a third-party system used for its Cinema 3 streaming service. Here is what happened, what was reportedly exposed, and steps you can take to protect yourself.

Identified:2 June 2026

Records (alleged):~25,000

Risk level:High

Your personal risk from this breach

View My Risk

What Happened

How the ACMI Breach Unfolded

Late May 2026

A threat actor gained unauthorised access to a third-party system used for ACMI's Cinema 3 streaming service, the platform ACMI uses for online film hire. The exact date of the intrusion has not been made public.

2 June 2026

ACMI identified the data breach. Its technology team contained the incident and secured the platform, and ACMI says a full review of its systems found no further breaches.

June 2026

A threat actor using the alias “2019” published a dataset it claimed contained the personal data of more than 25,000 ACMI customerson a hacking forum. The same actor claimed responsibility for the Melbourne International Film Festival (MIFF) breach around the same time. ACMI acknowledged the claims and confirmed some customer data was impacted, but said it had not verified the actor's specific figures.

ACMI said all customers who have hired an online title through its Cinema 3 streaming service are affected. The 25,000 figure and the exact fields are the threat actor's claims and had not been independently confirmed by ACMI at the time of writing.

June 2026

ACMI said it notified the Australian Signals Directorate's Australian Cyber Security Centre (ACSC) and worked with the Victorian Government Cyber Incident Response Service and the third-party provider to investigate the cause. ACMI confirmed that payment card details and passwords were not compromised, as those are not stored in the affected system.

Source: Cyber Daily

What Was Exposed

Personal Data Reportedly Leaked in the Breach

ACMI confirmed that some customer data from its Cinema 3 service was impacted and that no payment card details or passwords were exposed. The threat actor separately claimed the published data includes the fields below. ACMI had not confirmed the actor's specific figures at the time of writing, so the table reflects the actor's claims.

Data Type	Risk Level	Who Was Affected
Full name	High	Cinema 3 online-hire customers (in the published dataset)
Email address	High	Cinema 3 online-hire customers (in the published dataset)
Date of birth	High	Alleged by the threat actor (ACMI has not confirmed specifics)
Gender	Low	Alleged by the threat actor
IP address	Medium	Alleged by the threat actor
Order / rental details (titles hired, dates, payment method type)	Medium	Alleged by the threat actor
Sign-in metadata (no passwords)	Medium	Alleged by the threat actor

Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Name, email, and especially date of birth are rated High because that combination is commonly used to verify identity at banks and telcos and is a direct ingredient for identity fraud. IP address, order history, and sign-in metadata are rated Medium as account and phishing-reconnaissance data.

✅ Confirmed NOT Exposed

ACMI confirmed that payment card details and passwords were not compromised, because they are not stored in the affected system.

Company Response

What ACMI Did

“As soon as the breach was identified, our technology team contained the incident and secured the platform.”
ACMI statement (as reported by Cyber Daily)

Actions Taken by ACMI

Contained the incident and secured the Cinema 3 platform on identifying the breach
Conducted a full review of its systems, with no further breaches identified
Notified the Australian Signals Directorate's Australian Cyber Security Centre (ACSC)
Worked with the Victorian Government Cyber Incident Response Service and the third-party provider to investigate the cause
Confirmed payment card details and passwords were not compromised

ACMI Website OAIC Data Breaches

What Now?

Steps You Can Take After the ACMI Breach

No passwords or financial data were exposed, but the reported combination of name email and date of birth is a stronger identity-fraud ingredient than contact data alone. Here are general best-practice steps, organised by the accounts most commonly affected.

ACMI and Streaming Accounts

Your ACMI Cinema 3 details were reportedly exposed. Other streaming accounts may use the same email.

Secure your ACMI Cinema 3 account

~5 min

If you have an ACMI Cinema 3 account, it is good practice to update the password and enable multi-factor authentication (MFA) where available, and review recent account activity. ACMI has said passwords were not compromised, but changing it is a sensible precaution.

Go to ACMI Cinema 3

Review other streaming and event accounts

Where the same email address or password has been reused across other streaming, cinema, or event platforms, consider updating those credentials too. Credential reuse is one of the most common ways a single breach spreads to other accounts.

Email and Digital Identity

Your email is the key to your digital identity. Securing it is a sensible first step.

Strengthen email security

~5 min

Updating the password and enabling MFA on the email account tied to your ACMI Cinema 3 account is widely recommended. It is also worth checking email forwarding rules and connected-app permissions, which can be abused to silently intercept messages.

Understand your full account exposure

Most people have dozens of online accounts linked to one email address. When that email is exposed in a breach, mapping which services are connected is a critical first step in assessing your personal risk.

Identity Protection

Name and date of birth together are commonly used in identity verification by financial institutions.

Consider a credit ban (especially with date of birth exposed)

~20 min

Because date of birth was reportedly in the exposed data alongside name and email, the combination could be used in attempts to open credit in your name. Placing a free credit ban with Australian credit bureaus prevents new credit from being opened without additional verification.

Equifax AU Experian AU

Stay alert for targeted phishing

Exposed name email and rental history can be used to craft convincing phishing messages that reference real ACMI activity. Do not click links in unexpected messages, and verify through acmi.net.au directly.

Monitoring and Reporting

Australian resources for breach response and identity protection.

Contact IDCare or report to Scamwatch

IDCare (1800 595 160) is Australia's national identity and cyber support service and provides free, tailored guidance for people affected by data breaches. Reporting to Scamwatch helps authorities track emerging threats.

Check your exposure across breaches

Reviewing which of your accounts share the exposed email is a practical way to prioritise what to secure first, especially if your data also appeared in other recent Australian breaches.

Not sure which of your accounts are affected?

In The Event Of helps you find the accounts linked to your email and shows your breach exposure, so you can work through a clear, prioritised plan after an incident.

Check My Email Free

Are You Still at Risk?

The Hidden Danger: Compound Breach Exposure

The ACMI breach did not happen in isolation. If your data also appeared in other major Australian breaches, the combination of leaked information can build a more complete identity profile.

How breach data compounds

On its own, the ACMI breach reportedly exposed names, emails, and dates of birth. But if your email also appeared in the Optus or Medibank breaches, the combined data set may include identity documents, Medicare details, and health records. This kind of compound exposure significantly increases the risk of identity fraud.

Melbourne Film Festival / MIFF (2026)~26,782 records - name, email, phone, postal address
Optus (2022)9.8M records - passport, licence, Medicare numbers
Medibank (2022)9.7M records - health claims, Medicare details
ACMI (2026)~25,000 records - name, email, date of birth (alleged)

If your email appears in two or more of these breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.

Related Melbourne arts breach: MIFF (2026)

Days before the ACMI incident, the Melbourne International Film Festival (MIFF) was hit by a breach claimed by the same threat actor. If you have used both, your combined exposure is worth reviewing.

Read the MIFF guide

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

ACMI Breach FAQ

Sources

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

Melbourne Film Festival Data Breach 2026

~26,782 records exposed

Australian Centre for the Moving Image (ACMI) Data Breach 2026:What You Need to Know