An inquiry into the procurement and rollout of Canberra’s MyWay+ public transport ticketing project has heard detailed passenger personal information was likely left exposed on the internet for weeks before and after the system's launch. And while the government insists it took steps to ensure IT security, there's concerns breaches could have gone undetected.