TL;DR: On 27 July 2026, the NDIA said cyber criminals used phishing to obtain individual myGov credentials and access some NDIS accounts. It wasn’t described as a break-in to NDIA systems; people were tricked into handing over sign-in details. The NDIA hasn’t said how many accounts or whether plan funds were taken. Participants, nominees and carers should check plan funds, NDIS payments and bank accounts, switch myGov to a passkey, and never share codes. The NDIS "will never ask for your personal details by SMS." NDIS: 1800 800 110. Services Australia scams helpdesk: 1800 941 126. IDCARE: 1800 595 160.
What happened
From the NDIS news update (27 July 2026):
- criminals accessed some NDIS accounts through myGov;
- they got in through phishing, and by persuading people to give up their sign-in details;
- the NDIA is working with Services Australia, which runs myGov.
abilityNEWS quoted the agency: "Cyber criminals used phishing to obtain individual myGov credentials and access some NDIS accounts." It noted the alert "does not say how many accounts were accessed, what information was viewed or whether plan funds were taken," and that the NDIA is adding security measures and will contact people where it finds evidence of compromise.
Why NDIS accounts are a target
NDIS plans hold funding for supports. Someone with access could try to claim for services that were never delivered. Many participants rely on carers or nominees to manage their accounts, which gives scammers more people to trick.
The bigger myGov problem
This isn’t a one-off. According to IDCARE:
- more than 10,000 people reported misuse of their myGov and linked accounts in a 12-month period, almost double the year before;
- about 1,100 IDCARE clients reported fraudulent tax returns totalling $25.5 million;
- in 70% of cases, the person didn’t know how their account had been accessed;
- Services Australia dealt with over 10,000 agency impersonation scams in 2023-24, and 86% mentioned myGov.
What the NDIS and Services Australia will never do
"The NDIS will never ask for your personal details by SMS."
Services Australia says it will never:
- ask you to click a link to sign in to myGov;
- ask you to pay money to receive a payment or get help;
- ask for remote access to your computer or device;
- ask you to reply by email or text to a message it sent.
What participants and nominees should check now
- Plan funds: look for claims for services you didn’t request or receive.
- NDIS payments and bank accounts: look for anything unusual, including changed bank details.
- Contact details and representatives: check nobody new has been added, as Youngcare’s checklist suggests.
- myGov: review sign-in history and linked services (full myGov steps).
Lock myGov down: use a passkey
A passkey signs you in with your phone or computer’s fingerprint, face or PIN instead of a password. Services Australia recommends passkeys or Digital ID as more secure sign-in methods.
Why it matters here: a passkey "only works with the website or app it is created on," so a fake myGov page can’t steal and reuse it, according to the Digital Transformation Agency report quoted by iTnews. By the end of 2024, over 200,000 myGov users had switched off their passwords entirely and signed in with passkeys only.
Then:
- Change your password if you still use one, and don’t reuse it anywhere.
- Never share passwords or SMS codes with anyone, including someone "helping" over the phone.
- Sign in only through the myGov app or by typing my.gov.au.
- Run myGov’s security review, which walks you through the settings.
Who to contact
| Who | Number | For |
|---|---|---|
| NDIS | 1800 800 110 (8am to 8pm AEST, business days) | Plan and payment concerns |
| Services Australia Scams and Identity Theft Helpdesk | 1800 941 126 | If you shared myGov details or think you’ve been scammed |
| IDCARE | 1800 595 160 | Personalised identity theft support |
| Services Australia | reportascam@servicesaustralia.gov.au | Reporting a scam you saw but didn’t fall for |
You can also report to Scamwatch and ReportCyber.
For carers and support workers
If you help someone manage their NDIS, have the "codes" conversation: nobody from the NDIS, myGov or Services Australia will ever ask for one. A note on the fridge ("Never share a code. Ever.") can do more than a long briefing. Setting up a passkey together is a good second step.
Phishing lists are often built from breached email addresses. A free exposure check shows whether an email is in breach data.
Frequently Asked Questions
Were NDIS accounts hacked in 2026?
The NDIA said in July 2026 that criminals used phished myGov credentials to access some NDIS accounts. It did not describe a breach of NDIA systems.
How many NDIS accounts were affected?
The NDIA has not said how many accounts were accessed or whether plan funds were taken.
Does the NDIS ask for personal details by SMS?
No. The NDIS says it will never ask for your personal details by SMS.
What should NDIS participants check?
Plan funds for claims you didn’t request, NDIS payments, bank accounts, and any new contacts or representatives on the account.
What is the best way to protect a myGov account?
Use a passkey or Digital ID. Passkeys only work on the real myGov site, so they can’t be phished like a password.
Who do I call if I gave my myGov details to a scammer?
The Services Australia Scams and Identity Theft Helpdesk on 1800 941 126, and IDCARE on 1800 595 160.
Sources
- NDIS: Phishing scams (27 July 2026)
- abilityNEWS: NDIA hacked (28 July 2026)
- Services Australia: Scams column (May 2026)
- IDCARE: 10,000 myGov and linked accounts misused
- iTnews: Over 200,000 myGov users disable passwords in passkey shift
- Youngcare: NDIS myGov breach, what participants and families should know