As Australia reels from another “immensely harmful” data hack, the Australian Bureau of Statistics has revealed it has fended off close to a billion cyber-attacks against the census.
Australian statistician Dr David Gruen told the Melbourne Business Analytics Conference last week that after the 2016 distributed denial-of-service attacks which led to the first digital census being taken offline by the ABS for 40 hours, every effort was made to protect the census and its data.
“In the event, everything ran smoothly even though there were slightly less than one billion cyber-attacks on our census digital system on census day, 10 August 2021,” he said.
“Billion is not a misprint.”
A spokesperson for the ABS said the census systems were open from 28 July 2021 to 1 October 2021, and during that time the public-facing systems were under constant attack.
“While it is hard to quantify what an attack is, in our case these were connections that were obviously malicious which we blocked, either automatically or manually,” they said.
“On census day alone we blocked 308,735 malicious connections, and on investigating these we blocked 130,000 IP addresses which were the source of this attack traffic.”
Responding to the latest Australian ransomware attack, which has left Medibank customers worried about their health information being made public, cybersecurity minister Clare O’Neil said cyber-attacks were a part of “this new world”.
“There is an element here that cybercrime is growing really quickly around the world – there was an Interpol conference yesterday where the kind of police heads of forces from around the world got together and their message to the community was that cybercrime is now their main crime concern internationally,” she said.
“And this is the new world that we live in. We are going to be under relentless cyber-attack, essentially from hereon in.”
Medibank is the second major data hack in less than a month after Optus’s systems were breached in September.
One in two Australians responding to an Essential poll earlier this month said they wanted stronger privacy laws in light of the Optus hack. O’Neil has signalled the government is working on new legislation.
“I think [Medibank] combined with Optus, this is a huge wake-up call for the country,” she said.
“And it certainly gives the government a really clear mandate to do some things that frankly, probably should have been done five years ago, but I think are still very crucially important.”
O’Neil said she was particularly concerned due to the sensitive nature of the information held by Medibank.
“A lot of cybercrime relates to financial or identity information, which is very problematic when it comes into the public realm – what we have here is information that’s held by this organisation, which is healthcare information, and that just on its own being made public can cause immense harm to Australians,” she said.
The ABS instigated its census security strategy in 2018 but said it was an ongoing project. Ahead of the census, it prepared with DDoS testing, operational simulations and penetration testing from both private and public organisations to ensure the system was match-fit.
The ABS said it would continue to prepare for malicious cyber-attacks and has taken additional steps to protect the data it holds, which includes testing its systems with information security registered assessors accredited by the Australian Cyber Security Centre.
“After data collection and processing, names and addresses are removed from other personal and household information,” the ABS spokesperson said.
“Names and addresses are separated from other census data to protect privacy. We store names and addresses securely and separately from one another.
“For the 2021 census, the ABS will delete all names within 18 months of the census and addresses within three years. All paper forms from the 2021 census have been destroyed.”
The AFP has launched an investigation into the Medicare hack.
