KPMG Australia breached a contract with the country’s biggest federal agency by transferring sensitive government material outside its secure environment, prompting officials to consider firing the firm, documents reviewed by Reuters show.
The incident is the global accounting firm’s first apparent violation of client information-handling protocols regarding its vast portfolio of Australian government work — A$650 million ($456 million) in active federal contracts as of 2026.
KPMG’s Australian unit has been at the centre of a scandal over accusations it shared confidential private-sector client information to pitch for work, which it has admitted, but has maintained the conduct did not extend to government contracts.
The government incident in late 2025 involved Services Australia, which operates the country’s public health and welfare systems and handles data of most of the country’s population of 27 million.
Both KPMG and Services Australia said in comments to Reuters the matter did not involve any data breach, however the government agency has not awarded any new audit work to the firm since.
In an email the same day to another Services Australia general manager, Bond wrote that the information taken outside the government system was not of “particular concern”, but said: “I am more concerned that KPMG has acted outside the contract and has not taken any proactive steps to assure us of this fact”.
In a response to Bond on December 23, KPMG said the only document transferred outside the agency was an internal audit report template which had been deleted, and the KPMG employee involved would face follow-up action, including additional training.
The documents didn’t show whether Services Australia took additional measures, but an internal cybersecurity review into the incident concluded in January that the risk of data breach was low and closed it off.
KPMG said in a statement to Reuters it “confirmed with Services Australia that no confidential information was exchanged and reminded our people of their obligations in relation to data protocols”.
A Services Australia spokesperson told Reuters KPMG had “used its own network and email system, rather than the agency’s, to develop and distribute a draft internal audit report”, but the incident did not amount to a data breach.
The agency “considered the available contractual options”, the spokesperson added. Since “the work was substantially complete and remedial action had been taken, the agency finalised the engagement rather than terminate the contract”.
“This was the only instance of this type occurring and Services Australia has not awarded KPMG additional internal audit work since the incident,” they said.
The agency gave KPMG an A$12 million multi-year contract in 2024 for “program assurance services”, and in April awarded the firm an A$69,850 contract to provide actuarial services, according to published government tender data.
