When Andrew Connor received an email from the Tasmanian government, highlighting that his personal data may have been included in a cyber attack, it raised a number of questions.
Mr Connor was among the 145,000 recipients of the email, which lists the agencies within the state's Education Department that may have been included in the hack that was carried out by a ransomware group.
Among those affected was TasTAFE, the only institution listed that Mr Connor had been connected to.
However, this interaction finished years ago.
"The only way I can think I have been exposed through this is as a TasTAFE student doing a single course seven years ago," he said.
"So it's just strange that that data is still hanging around, and has potentially been exposed now.
"That data, for whatever reason, may have been sent to a third party to send out a statement, but it really should have been deleted soon after that transaction, not hang around for seven years."
He is worried that his date of birth is among the information compromised, based on a student record statement.
Mr Connor — the spokesperson for consumer group Digital Tasmania — said the government needed to inform Tasmanians about exactly what information had been leaked as part of the hack on third-party file transfer system GoAnywhere MFT.
"Is it just an invoice? Is it a student record statement, including a date of birth? Or is it just a mailing list, just an email address? So there's different consequences for those different categories of information," he said.
"There's people in delicate situations — say it's foster care, or single-parent families — where addresses can be exposed.
"The government needs to be clear on what has been exposed per person here, rather than a blanket general email with phone numbers to Lifeline."
The hackers have, so far, published 16,000 transactional documents as part of the cyber incident.
It stems from a breach, in early February, of Fortra's GoAnywhere system that resulted in data from 130 organisations around the world being leaked.
The state's science and technology minister, Madeleine Ogilvie, said she was informed of the incident on March 25, and told the public on March 31.
"I was informed, we investigated. I satisfied myself with good support that it was a credible risk. And we moved towards a Friday date [to issue a press release]," she said.
"At the point where I was allowed to make a statement that there was a credible risk, I did so immediately."
No ransom request — yet
In addition to the 145,600 emails, the government also sent out 2,500 letters and made 377 phone calls to alert people who may have had their personal data compromised.
There has so far been no ransom request, nor further documents published beyond the initial 16,000.
Other agencies included in the data hack are the Teachers Registration Board, the Commissioner for Children and Young People, Libraries Tasmania and the Office of Tasmanian Assessment, Standards and Certification.
Premier Jeremy Rockliff said that, given the length of time people were typically engaged with the department, the data could go back a significant period.
"How long records go back is a matter for individual departments," he said.
"There may well be information, of course — we have a school system of 13 years of compulsory education — and no doubt data is stored for some length of time."
The government has promised to review its cyber security arrangements, once the immediate response to the cyber attack has been finalised.
Police Commissioner Donna Adams and Department of Premier and Cabinet secretary Jenny Gale sent a letter to Tasmanian media outlets and opposition political parties on the weekend, raising concerns about "current media messaging" which could be "fuelling" the hackers' business model.
No examples were provided.
"We'd strongly encourage a united approach," it reads.
Mr Rockliff defended the letter, and said he received the same advice.
"It's not about not being open and transparent. I'm here now, answering questions to you all," he said.
"It's about ensuring that we have a very measured response so that we don't play into the hands of criminal hackers."
Labor described the letter as an attempt to "silence" the media and opposition from criticising the government.
