Fairfax Media has been told the messages were downloaded on a Vodafone "hard drive" and the contents shared in an email between two employees, one of whom now works for another telecommunications firm.

Sources have also revealed that the downloaded data included the content of messages – both sent and received – over a 28-day period. Those messages were compiled and presented in a spreadsheet, a copy of which was supplied to KPMG, which had been hired by Vodafone to investigate other activities.

The development reveals the extent of the privacy breach. Vodafone last week told Fairfax Media it was a lone employee who had accessed "some texts messages and call records of a customer."

In January 2011, Fairfax investigative journalist Natalie O'Brien broke a story exposing security flaws with Vodafone's security system. The inadequacies carried major implications for the privacy of its customers. A day later, Vodafone investigators discussed infiltrating her phone to find out the identity of her source.

In a leaked email written in 2012, Vodafone Group's then head of fraud Colin Yates said he had "no reason to believe" the allegations of Ms O'Brien's records being compromised were not correct and there was a "huge risk" to Vodafone if the information "gets into the public domain".

"If the issue relating to breaching the reporter's privacy by searching her private call records and text messages gets into the public domain, this could have serious consequences given it is a breach of the Australian Telecommunications Act," the email continued.

When the breach was revealed last week, Vodafone initially denied any allegations of improper behaviour. However, since then, it has reported the matter to the Australian Federal Police. Its chief executive, Inaki Berroeta, has also approached Ms O'Brien, to personally apologise for the "unacceptable and potentially criminal" activities.

But NSW Regulation Minister Victor Dominello believes the company's attempts to lay the blame on a former "rogue employee" are "offensively inadequate" as was its failure to take "appropriate action" and alert police when it originally became aware of the hack.

Privacy lawyer George Newhouse agreed, describing Vodafone's actions as "despicable". He said: "The fact that Vodafone failed to notify her of the breach immediately (once the facts were known) should worry all Australians."

In a statement made on Friday, a Vodafone spokeswoman said the company was "cooperating fully" both with the AFP, and with enquiries from the Office of the Australian Information Commissioner and the Australian Communications and Media Authority. "The privacy of our customers and protection of their information is our highest priority and we take this responsibility very seriously," she said.