It was a cold, windy June morning in Melbourne when Steph and her brother clambered into a car to drive to their parents' house.
They weren't told what their parents wanted to talk about, only that it was important enough that it had to be done in person.
Steph knew something was wrong the second she walked in the door and saw her parents' faces. The atmosphere was too still and felt like ice, she said.
Her mum took control, and asked them both to come into the bedroom; their respective partners had come too but they were to stay in the living room.
Steph, her brother and mum sat on the edge of their parents' bed as their dad brought in a chair from the living room, sat facing them, and started crying.
Steph looked at her mum, as she had always done, for reassurance and comfort.
"We wanted kids so bad," her mum had told her.
"But we struggled with infertility for 10 years. This is something we needed to do.
"The only way we could conceive you both was through a donor."
Steph sat very still, picking at loose threads on her parent's white duvet with her fingernails, as she found out she was not biologically related to her dad.
It tore a "hole" through her identity, Steph said.
Her mum explained that, at the time, they had been advised by medical professionals to forget they had ever used a donor at all. To lie to their children about where they came from, to never tell them about their biological roots.
Their parents were only telling them now because Steph's brother had been gifted an ancestry kit for his birthday and they didn't want them finding out that way.
Steph cried the entire drive home. Her mum had said they weren't to tell anyone except their partners.
No-one really knew what to do, she said. It wasn't a situation anyone had ever imagined, let alone had experienced.
Steph left her parents' place that day with plenty of questions about her identity.
Now leaked documents reveal the database she relied on for answers is at risk of being breached or corrupted.
Database at 'extreme' risk of being breached
The information on Steph's donor is housed in a register at the Victorian Assisted Reproductive Treatment Authority (VARTA).
VARTA itself is due to be disbanded by the end of the year when the Victorian government takes over reproductive health regulation.
An IT review from consultancy firm KPMG last year, found the integrity of the decades' worth of data held by VARTA was at "extreme" risk of being compromised.
According to the review, the register manages the details of more than 35,000 people who have either donated sperm or eggs, received donor treatment, or are a donor-conceived person.
It's how people born via donor egg or sperm can match and connect with their donor.
It's also how the regulator vets donors. In Victoria, up to 10 women — from anywhere in the world — can have children from the same donor to reduce the risk of half-siblings forming intimate relationships.
The report also revealed the number of people in Victoria undergoing treatment using donor sperm or eggs was growing at a rate of about 8 per cent each year.
The KPMG report found an extreme "lack of cyber security awareness and security measures in place".
VARTA board minutes also leaked to the ABC showed the Victorian government had rejected a request from VARTA in 2018 for about $723,000 in funding for an IT upgrade.
In 2021, VARTA submitted another bid for funding, but it was rejected because the regulator could not prove "the direct economic benefit".
Another report from 2021 by the health department, showed there were "major concerns over ongoing data corruption" and "irreplaceable information" was at risk of being lost.
The 2023 KPMG report shows VARTA was last year undergoing an update of its storage systems, but was experiencing delays.
The KPMG report said at the time, the delays posed "an immediate risk to not only VARTA, but also to the applicants, donors, donor-conceived people and their families."
The health department will take over regulating reproductive technologies like donor conception, next year.
A spokesperson said the department was moving the register to a "new, upgraded system … with data security a key consideration of the new system".
'Mum said she swore he was shorter'
After Steph found out she was donor conceived, she discovered her biological grandmother on the donor's side had died from a potentially hereditary cancer.
There were other medical complications she had been through including being diagnosed with a benign brain tumour and being hospitalised for what doctors had thought was a stroke but was put down to intense migraines.
"Finding out I'm donor conceived has made me reassess my entire medical history. I don’t know whether I’m the only one with these medical conditions or if there is a genetic link," she said.
She started wondering if she got her body shape — which was so different from any of the other women in her life — from her donor's side.
It was like "a hole in your soul, in your identity", she said.
"I'm just sitting there with a million question marks over so many facets of who I am as a human."
Steph said it was "terrifying" to know the information on the database could be lost and she already thought some of the information she had received may be incorrect.
"The height is strange, my Mum said she swore he was shorter because she said we wanted a donor that was similar in height to dad," she said.
"Admittedly this was 30 years ago but some of that information may have been lost or changed. Knowing that something that's so fundamentally private about me … could be accessed by anyone, or that a computer malfunction could be the reason that I don't get answers is insane."
'Nothing is more important than our health data'
Monash University cyber security professor Nigel Phair said compromised information could be stolen by hackers and sold on the dark web, it could be modified, or casually observed by employees.
He said the information in the leaked reports read like many he had seen before.
"Nothing is more important than our health data to Australians — it's super serious, very personalised information, and they haven't gone through the proper control framework," he said.
Rebecca Kerner, chairperson of the Australian and New Zealand Infertility Councillors Association, said the information held on the donor register enabled donor-conceived people to know where they came from.
"Making sure that we have a system where this information is entirely secure is critical. For many young people, it's a massive piece of their identity," she said.
Donor families urge government to reconsider changes
Donor families and individuals like Steph have been urging the government to reconsider the move to disband VARTA due to its world-leading status.
As part of the shift, a new Health Legislation Amendment Bill will remove the legal requirement for the government to offer counselling to families who want to meet their donor, and provide public education on treatments like donor-conception and IVF.
Face-to-face donor-linking services with a counsellor who helps mediate a meeting between a donor and their donor child will also be replaced with an online portal.
A government spokesperson said the health department would continue supplying educational material, and counselling would still be available, but would change from a mandated to "a voluntary process — giving each individual more say in the level of support they need".
"Qualified and experienced counsellors will deliver quality, culturally safe voluntary counselling for people should they wish to access it and public education is continuing," they said.
Steph recently launched a petition to stop the legislation from passing in its current form.
"Discovering that you are donor-conceived disrupts your sense of identity and causes you to desperately seek answers about your genetic risks and heritage," she said.
"There's no benefit for the donor to jump on here and use this website. Their medical information is really what we need from them, and if someone has a severe disability or a mental illness they're not going to be readily accessing this [platform]."
