Personal details of 80,000 South Australian public servants stolen in cyber-attack
Records including the name, tax file number and banking details of almost 80,000 South Australian government employees may have been stolen in a cyber-attack, with workers advised to assume their personal information has been stolen.
The South Australian treasurer, Rob Lucas, first disclosed on Friday that records of 38,000 government employees had been stolen in a cyberattack, but confirmed the extent of the data breach on Tuesday.
The attack was carried out against Frontier Software, an external company that has provided the South Australian government’s payroll software for the last 20 years. It affects employees working for the government as of July last year, with only employees at the Department of Education excluded from the hack.
Investigations are ongoing but it is believed the incident involved a ransomware attack by Russian hackers that took place five weeks ago.
The personal information stolen includes – but is not limited to – employees’ first and last names, date of birth, tax file number, home address and bank account details.
Lucas apologised to employees affected saying it was a “very serious breach”.
“It’s almost everyone, members of parliament, right through to the premier, also people who serve on government boards and committees,” he said. “To the extent we can, we are providing the maximum amount of security we can now that this has occurred.”
All employees were advised to take security steps such as changing passwords and security questions used to identify a person while monitoring their accounts for any unusual activity.
Lucas said the government could not immediately terminate the contract with Frontier Software as it would take at least six months to find a new provider.
Frontier Software Australia CEO Nick Southcombe said the company, was monitoring for any other suspicious activity as further investigations continued.
“We are continuing to communicate closely with our customers to share the latest information about the incident, as well as offering additional cyber security support to ensure the ongoing security of their systems,” Southcombe said.
“We can confirm that this is the first such cyber incident that Frontier Software has ever experienced. We are committed to learning from this experience and implementing all necessary cyber security measures to minimise the likelihood of an incident occurring in future.”
In a notice posted on its website on 9 December, Frontier Software said some of its Australian customer systems had been hit be a cyber incident on 13 November and it had begun informing clients.
The SA Privacy Committee, Office of the Australian Information Commissioner and the Australian federal police have been notified about the incident.
Public Service Association acting general secretary Natasha Brown said the union was seeking legal advice on behalf of its members.
“The government must take full responsibility for the integrity of this very sensitive data,” Brown said. “The government might have privatised the service – but they cannot privatise their responsibility for our members’ personal sensitive data.”
“The PSA expects the government to cover any costs to members of any adverse consequences of this serious data breach – including any financial losses.”
Justin Warren, chair of Electronic Frontiers Australia, said the incident was “all too familiar” and that those affected should be compensated for “the work they have to do to respond to this violation of their privacy”.
“This data breach demonstrates, yet again, that once government or business has your data there is very little you can do if their cybersecurity isn’t good enough,” Warren said. “Governments keep demanding we trust them with our data but I struggle to see why anyone would. If governments want our trust they have to earn it.”