Where The OAIC sits in the flow of extraction.
Office of the Australian Information Commissioner
The regulator administering the Notifiable Data Breaches scheme, which binds whoever holds personal information, not whoever got into it; on THE RORT's reading the scheme was never built to reach a company that accessed someone else's system rather than losing data from its own.