A statement from the NSW Cyber Crime Squad said the man had gained access to customer details and a small number of payment card details. There was, however, no indication of fraudulent use but inquiries were continuing.
GoGet said in a statement that its IT team had identified the breach on 27 June and informed the NSW Police’s Cyber Crime Squad.
The company appears to have its systems hosted by Amazon.
"In the process, as part of his overall activity on the system, it also appears that the suspect has accessed personal information of GoGet’s members and individuals who have previously attempted to create a GoGet account."
The NSW Cyber Crime Squad said that, with help from company staff, it had identified that unauthorised access had been gained to the company’s fleet booking system and customer IDs from the database were stolen.
The suspect, 37, has been refused bail and will appear in court later today.
GoGet advised the customers whom it had contacted to "review and continue to monitor your credit report for any discrepancies or unusual activity".
"You can apply for an annual free credit report from each of the three national consumer Credit Reporting Agencies (Equifax, Dun & Bradstreet, and Experian) or if you have ever held credit in Tasmania, from the Tasmanian Collection Service."
A dedicated Web page has been set up by GoGet with relevant information.
Commenting on the incident, security firm Webroot's senior expert Randy Abrams said that it was unfortunate that the use of encryption was not ubiquitous as this would have made the data that was stolen inaccessible.
“GoGet, and all other businesses owe their customers the protection of encrypted personal data. It is most unfortunate that the use of encryption is not ubiquitous," he said.
"While we’re all pleased that the alleged perpetrator was brought to justice, this breach brings up many questions on defining what ‘responsible disclosure’ means for companies – especially when it relates to cyber attacks.”
Abrams was of the opinion that the punishment meted out to the attacker should send a message to others that this was serious business.
He said given that companies were in general quite behind the eight-ball when it came to security, there should be a disincentive for people to break into systems even if they were poorly secured.
Educating IT staff on cyber security essentials was vital, Abrams noted, adding that if there was no in-house expertise then a managed service provider should be engaged.