The au Domain Administration, the organisation that administers the Australian domain namespace, now says attackers who claimed they had breached its network have provided evidence of the breach.

auDA had initially said it had found no evidence of the breach that was notified to it on Friday afternoon.

In a statement on Sunday, auDA said: "Today, the cyber criminal has provided evidence of a small sample of data they say is in their possession. It includes screenshots of a file list from a computer.

"Our investigation remains ongoing, including to verify the cyber criminal’s claims and the provenance of this data. We will provide an update when further information is available."

As iTWireon Saturday, a ransomware group named NoEscape claimed on its website on the dark web on 11 August that it had breached auDA's site, adding that it had pilfered more than 15GB of data.

In an update to the initial notice, the group said: "...if you do not contact us, the first step will be to sell access to bank accounts with balances over $4k.

"For the bad behaviour of the company, we reduce the time on the timer from 8 to 3 days."

That timer is now down to a shade more than two days.

NoEscape has released four screenshots on its site, two of which appear to be listings of some of auDA's clients.

auDA said it took claims about breaches "extremely seriously".

"auDA worked quickly to notify the Australian Cyber Security Centre, the Department of Home Affairs and the Office of the Australian Information Commissioner and began work with industry experts to investigate the claim," it added.

The ransomware group claims the documents it has stolen during the breach include "powers of attorney and legal documents with seals, passports, personal data, medical reports, loan repayment, dismissal documents, declarations, death certificates, access to customer bank accounts (name pw bsb acc nmbr...), taxes, projects, and much more confidential information".