It might seem like data breaches are occurring more frequently than ever in the wake of the Optus cyber-attack, but while cybercrime incidents are constantly on the rise, Australia isn’t really a hot new target.
Since Optus first disclosed its massive data breach at the end of September, breaches or attacks have been reported by Medibank, Woolworths’ MyDeal, EnergyAustralia, Vinomofo and Medlab.
And those are just the ones that we’ve heard about.
But cybersecurity experts say it’s just that companies have been more forthcoming in announcing data breaches since Optus – and the media has been more focused on reporting them.
Businesses regularly report breaches or attacks to the Australian Cyber Security Centre, but they don’t always publicise them or inform customers – particularly in cases where it is not immediately evident customer data has been compromised.
According to the ACSC’s latest threat report, the agency received 67,500 cybercrime reports in the 2020-2021 financial year – up 13% on the previous year. That equates to one report every eight minutes.
Meanwhile, Australia’s mandatory data breach notification scheme – which has been in place for four years – received 853 notifications in the last financial year.
Companies or agencies are required to notify in cases where the breach is “likely to result in serious harm to one or more individuals and the organisation or agency hasn’t been able to prevent the likely risk of serious harm with remedial action.”
Most of these breaches are never reported in the media.
But the scale of the Optus data breach, which affected about 10 million customers, along with the strong government response renewed interest in what is often an underreported topic.
The disagreement between Optus and the government about the nature of how the breach occurred – whether human error or a “sophisticated” attack – became a focus of the reporting. Companies since have been keen to avoid getting into a similar tangle.
As a result Medibank was much more transparent from the start. That’s why it has sometimes appeared as though the story had changed day-to-day.
The company initially said it looked like an attacker may have had access to a small amount of customer data, to revealing over the course of two weeks that the attacker had obtained access to Medibank’s entire customer base, with 200GB of data extracted.
It’s messy, but Medibank, anxious to avoid a repeat of the Optus debacle, updated the public about the attack as the company learned it – in this case from the alleged attacker.
In the past, the Woolworths’ MyDeal, EnergyAustralia, Vinomofo and Medlab breaches might have been reported, but would probably not have received as much attention. The number of customers in these cases were smaller and in all but the Medlab case, the data was not as sensitive.
In fact, Medlab sat on information about their breach for five months, including that the personal information – pathology information, credit card numbers and Medicare numbers – of 223,000 customers had been posted on the dark web.
Medlab identified the breach in February, found it online in June, but waited until this week to report it. The company has blamed the complexity of the data obtained for the delay in publicly reporting, but from the outside it looks like something of a “taking out the trash” moment.
It wouldn’t be surprising if we saw more breaches reported in the coming weeks as companies use the cover of much larger breaches to make their own public.
While cybercrime is rising and will continue to rise in Australia, increased public awareness of these attacks can only be a good thing.
