Getty Images/iStockphoto
More data breaches in Australia arising from ransomware
The number of data breaches in Australia arising out of ransomware attacks grew by 24% during the first half of 2021, according to OAIC’s latest data breach report
The number of data breaches in Australia arising out of ransomware attacks grew by 24% during the first half of 2021, underscoring the growing threats posed by the global proliferation of ransomware in recent years.
According to Office of the Australian Information Commissioner’s (OAIC) latest Notifiable data breaches report, the number of data breaches arising from ransomware incidents increased from 37 notifications in the last reporting period to 46.
In total, the OAIC received 446 data breach notifications from January to June 2021, with 43% of these breaches resulting from cyber security incidents.
Australian information commissioner and privacy commissioner Angelene Falk said the increase in ransomware incidents was cause for concern, particularly due to the difficulties in assessing breaches involving ransomware.
“We know from our work and from the Australian Cyber Security Centre that ransomware attacks are a significant cyber threat,” said Falk.
“The nature of these attacks can make it difficult for an entity to assess what data has been accessed or exfiltrated, and because of this we are concerned that some entities may not be reporting all eligible data breaches involving ransomware.
“We expect entities to have appropriate internal practices, procedures and systems in place to assess and respond to data breaches involving ransomware, including a clear understanding of how and where personal information is stored across their network.”
Read more about cyber security in Australia
- Australian healthcare provider Eastern Health takes IT systems offline as a precaution while it looks into a cyber incident.
- Australian state agency Transport for New South Wales is the latest victim of the supply chain attack against Accellion’s legacy file transfer system.
- Australia’s latest cyber security strategy includes centralised management of networks and a voluntary code of practice for deploying internet-connected devices, among other areas.
- Supply chain security risks can wreak havoc for Australian firms if measures are not taken to deter cyber attackers from exploiting a supplier’s security gaps to target another firm.
The OAIC was also notified of a number of data breaches resulting from impersonation fraud, which involves a malicious actor impersonating another individual to gain access to an account, system, network or physical location.
“The growth of data on the dark web unfortunately means that malicious actors can hold enough personal information to circumvent entities’ ‘know your customer’ and fraud monitoring controls,” Falk said.
“We expect entities to notify us when they experience impersonation fraud, where there is a likely risk of serious harm.
“Entities should continually review and enhance their security posture to minimise the growing risk of impersonation fraud,” she added.
Although the number of data breaches resulting from human error fell from 203 to 134 this time round, they still accounted for about a third of all breaches.
Falk said entities need to remain alert to this risk, particularly the Australian government where 74% of breaches fell into this category.
“Human error remains a major source of data breaches. Let’s not forget the human factor also plays a role in many cyber security incidents, with phishing being a good example,” she said. “Organisations can reduce the risk of human error by educating staff about secure information handling practices and putting technological controls in place.”
