Personal information describing names, addresses, bank account details, and taxation IDs of 38,000 Australian government employees has been leaked to the dark web after a ransomware attack.

The treasurer of the Australian State of South Australia, Rob Lucas, today [1]revealed the source of the leak: outsourced payroll provider Frontier Software.

Frontier had previously advised that the attack had been deflected and customer data was safe. On November 16, the company [2]admitted it was "experiencing a cyber incident which has resulted in limited access to some of our computer systems and data". The next day, Frontier [3]advised customers that service had been restored and that its investigations "show no evidence of any customer data being exfiltrated or stolen". Customers were told that some data was encrypted, but it was nothing to worry about as "Australian customer HR & Payroll data and systems are segmented from the corporate systems and were not compromised".

[4]

That initial assessment was wrong. On December 9, Frontier [5]admitted "some data exfiltration" occurred and "a small number of Frontier Software customers" were whacked.

[6]

[7]

One of those clients was the State Government of South Australia.

[8]Canadian charged with running ransomware attack on US state of Alaska

[9]Microsoft wins court approval to take over sites run by Chinese crime gang

[10]Lloyd's of London suggests insurers should not cover 'retaliatory cyber operations' between nation states

Treasurer Lucas said the number of staff whose personal data had been leaked was somewhere between 38,000 and 80,000.

Names, addresses, salaries, birthdays, and bank account details were all accessed. Tax File Numbers – an identifier used widely in Australian life to prove identity for chores such as obtaining a passport – were also accessed.

Lucass's announcement states that all impacted staff have been informed, but he nonetheless warned all to contact their banks, change passwords, adopt 2FA, and watch for suspicious transactions.

[11]

With at least 38,000 records out there, this incident will have a significant blast radius. One small upside is that, while Frontier Software operates outside Australia, it appears only Australian data was accessed.

On the downside, the incident shows your security is only ever as strong as your suppliers'. ®

Get our [12]Tech Resources



[1] https://www.roblucas.com.au/media-releases/statement-re-ransomware-cyber-attack-directed-at-frontier-software/

[2] https://au.frontiersoftware.com/news-and-articles/frontier-software-cyber-incident

[3] https://au.frontiersoftware.com/news-and-articles/australian-update-cyber-incident

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YbMzZXp5AmdlPAKCm1WYRAAAAFg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://au.frontiersoftware.com/news-and-articles/australian-update-cyber-incident-0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YbMzZXp5AmdlPAKCm1WYRAAAAFg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YbMzZXp5AmdlPAKCm1WYRAAAAFg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2021/12/08/canadian_man_ransomware_alaska_charged/

[9] https://www.theregister.com/2021/12/07/microsoft_nickel_takeover/

[10] https://www.theregister.com/2021/11/30/lloyds_london_cyber_insurance_clauses/

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YbMzZXp5AmdlPAKCm1WYRAAAAFg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[12] https://whitepapers.theregister.com/