Cyber Threat Actor: Meriton Hacker

The threatactor known as Meriton Hacker has been publicly referenced in connection with a cybersecurity incident affecting an Australian organization. Open‑source reporting identifies the alias Meriton Hacker as the name used by the unidentified third party responsible for the breach. The actor’s location is indicated as Australia, based on the contextual details of the reported incident. No additional aliases or affiliations have been disclosed in the available sources. The actor’s activity to date is limited to a single reported breach that occurred in January 2023.

On 2023‑01‑14 a major Australian property and hospitality entity suffered a compromise that exposed extensive personal data. The compromised staff information included tax file numbers, bank details, employment records, salaries, disciplinary proceedings and health data. Guest data that was accessed comprised contact details and health‑related disclosures such as incident reports. The breach involved the exfiltration of approximately 35.6 gigabytes of material by an unidentified third party. The affected organization responded by notifying potentially impacted individuals and engaging cybersecurity experts to contain the incident and reduce further risk. Public statements from the organization noted that, at the time of reporting, there was no evidence that the stolen data had been misused.

Based solely on the observed actions, the actor’s apparent objective in this incident was the acquisition and removal of sensitive personal information. The targeting appears to have been confined to the Australian property and hospitality sector, as no other victims or geographic focus have been reported. Because the sources do not describe malware families, initial access vectors, tooling, or any state or criminal affiliations, those aspects of the actor’s profile remain undetermined. No further campaigns or operations have been publicly attributed to Meriton Hacker beyond the January 2023 breach. Consequently, any description of the actor beyond the facts presented here would rely on speculation and is therefore omitted.