Risk level: high. Can you change it: no. Found in 1 breaches in this directory.
What this data is
Records of a physical, sensory, intellectual or psychosocial disability, or of accessibility needs and support arrangements, held by employers, insurers, schools, transport providers, disability services and government agencies.
The risk on its own
Disability information is health information, and privacy laws treat it as sensitive for good reason. Exposure can lead to discrimination at work, in insurance or in housing, and to stigma people have worked hard to manage. Once others know, it cannot be taken back.
The risk combined with other data
With your name, address and phone number, it singles out people scammers see as easier targets, including people with cognitive disabilities or who rely on carers. It can also reveal support or benefit payments, which invites impersonation of disability agencies. For some people it shows that they live alone or have limited mobility.
How criminals use it
A caller claiming to be from a disability support agency says your funding will stop unless you confirm your bank details.
A fake provider offers equipment or services linked to your disability and takes payment for nothing.
An employer or landlord who sees the record treats you less favourably.
Someone who knows you live alone with limited mobility targets your address for theft or doorstep fraud.
What to do now
Ask the organisation exactly what was exposed, and ask what support it offers people affected by the breach.
Tell carers, support workers and family that scam calls about your funding may follow, and agree that any payment or provider change is checked with the agency directly.
Check your support or benefit account for changed bank details, plan managers or providers. In Australia, review your my NDIS portal through myGov.
If you face discrimination, complain to the relevant body, such as the Australian Human Rights Commission, the EEOC in the US or the Equality Advisory and Support Service in the UK.
Complain to the privacy regulator if the breach was handled poorly: the OAIC in Australia, the ICO in the UK, or the HHS Office for Civil Rights for US health providers.
Frequently asked questions
Can I be discriminated against because this leaked?
Disability discrimination is unlawful in employment, housing and services in most countries, however the information came to light. Keep records and get advice if it happens.
Is disability information protected by privacy law?
Yes. It counts as health or sensitive information under laws such as GDPR, the Australian Privacy Act and HIPAA where it applies, which puts stricter duties on the organisation that lost it.
What scams usually follow a leak like this?
Fake calls from disability agencies about funding, fake equipment offers and doorstep fraud. Always check by contacting the agency yourself.
Breaches that exposed this data
University of Nottingham: 2026-06-09, 455K accounts, Academic records, Citizenship statuses, Dates of birth, Disabilities, Email addresses, Ethnicities
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.