by Ganesh Sahathevan
Anthony Ching is a Board member of the NSW Chinese Community Association (CCA).
20,000 people still unaware of Service NSW breach
Affected residents don’t know their data was stolen last year.
The NSW government has been unable to notify at least 20,000 people who were impacted by a data breach at Service NSW last April.
It has been notifying people affected by the breach through registered mail.
Speaking to a NSW Inquiry into Cybersecurity last week, CEO of Service NSW Damon Rees said the department had “been able to reach 70 to 80 per cent” of the 104,000 people whose personal information was compromised in the phishing attack.
Last year’s incident saw 47 Service NSW staff email accounts hacked, resulting in the breach of five million documents, 10 per cent of which was understood to contain personal information.
“We are still ensuring that all our customer notifications have been successfully received by customers,” Rees told the committee.
“We get them returned to us by Australia Post where that has not been the case.”
In December, the NSW Auditor General handed down its report into the April breach, finding Service NSW “is not effectively handling personal customer and business information to ensure its privacy”.
The audit report slammed Service NSW for its process of emailing personal information of clients – a practice that was still occurring late into last year.
A lack of multi-factor authentication was also mentioned as a contributing factor to the breach.
Rees said Service NSW had already begun to reduce the risk of major breaches by removing all emails older than 60 days from customer service inboxes. He was also looking into more modern ways of storing sensitive information.
“Part one of this risk is to hold less,” he said. “Part two is to find a secure alternative to the transfer of information.
“We have a number of technologies that we are looking at there and piloting at the moment.
“We need to be very careful that when we make that change, we make it to a more secure alternative and that we get the processes and the human elements right around that, as well as the technology.”
Greens MP David Shoebridge questioned the NSW Chief Cyber Security Officer, Tony Chapman, as to why Service NSW was managing sensitive private information by email in the first place.
“Would it be fair to say that if you were designing a system that wanted to protect people's privacy and have as many layers of cybersecurity as possible, you would not start with emails?” Shoebridge asked.
Chapman’s response: “which is why agencies across New South Wales were actually, in fact, using Accellion as an alternative to email”.
The Accellion File Transfer Appliance (FTA) – a legacy product from the software vendor Accellion – had been earlier named by Chapman as part of another security incident affecting the Health Department and potentially other NSW agencies.
“The New South Wales Government and Cyber Security NSW are aware of the security incident that has impacted a third party provider,” Chapman told the committee.
“Cyber Security NSW is coordinating a whole-of-government response with potentially impacted agencies.
“We are working with forensic specialists as well as Accellion to determine the extent of potential impact, and that is ongoing.”
A vulnerability in Accellion’s FTA was behind a recent breach at the Australian Securities and Investments Commission (ASIC) which had occurred days after Accellion had rolled out patches to the small number of clients still using its old file-sharing system.
More than 180,000 New South Wales residents are believed to have been caught up in a major cyber security breach after a state government department was compromised earlier this year.
Key points:
- Service NSW began investigating the breach in May after staff emails were compromised in April
- NSW Police are investigating who accessed the sensitive information
Opposition MP Sophie Cotsis criticised the Government for taking months to inform customers
Service NSW on Monday morning confirmed the large number of people likely impacted in the breach which was first reported publicly by the Government in May.
Those caught up in the "criminal attack" are now set to be informed by the department via registered post in the coming days.
Service NSW chief executive Damon Rees confirmed the scale of the incident in a statement, saying millions of documents may have been compromised.
"The investigation, which began in April, engaged forensic specialists to analyse 3.8 million documents in the accounts," he said.
"This rigorous first step surfaced about 500,000 documents which referenced personal information."
Mr Rees said the data comprised documents such as handwritten notes and forms, scans, and records of transaction applications.
"Across the last four months, some of the analysis has included manual review of tens of thousands of records to ensure our customer care teams could develop a robust and useful notification process.
"We are sorry that customers' information was taken in this way."
'It shouldn't take four months to notify people'
The incident was discovered after the email accounts of 47 staff members were first compromised in April.
Requests by ABC News under freedom of information laws for more information about the breach were rejected by the department in July, on the grounds an investigation was ongoing.
NSW Police are actively involved in the investigation to determine who accessed the sensitive information.
Opposition MP Sophie Cotsis said the breach was "unprecedented".
"It is extraordinary that this attack has been allowed to happen.
"Whether it's births, deaths and marriages, registration, guardianship information — today people should be questioning whether they trust the information that they're providing to the Government and the security measures that the government is taking to keep their information safe."
She also criticised the Government for taking four months to alert residents.
"This is extraordinary — this is four months and they haven't notified people," she said.
"The last we heard is that they're going to [use] registered mail notification, I mean that's outrageous.
"It shouldn't take four months to notify people whose information has been leaked and cyber criminals have access to that information."
