NSW data leak victims get ‘hypercare’

Service NSW established a “hypercare team” to help mitigate the effects of a cyber attack in April that saw bad actors access emails of 47 staff members.

NSW Minister for Customer Service, Victor Dominello, finally spoke out on Tuesday following revelations this week that almost 200,000 NSW residents were affected by the breach which saw 736 GB of data stolen.

In a LinkedIn post, Dominello said Service NSW established a “hypercare team” to look after those whose personal information was stolen by bad actors in a cyber attack.

“When crime occurs we focus on catching the criminals,” Dominello said.

“However, it is just as important to support the victims. Identity theft is not a victimless crime.”

Service NSW said people whose personal information was compromised would receive a notification through the post over the coming months.

Dominello said the breach “primarily” gave attackers access to scanned documents in emails – such as copied drivers licences – and that the agency has created a “permanent identity recovery unit” to support victims.

“With email attachments, we have digitised the delivery but not the parcel,” he said.

“It is a typical legacy problem. It exists in governments and organisations alike. True end-to-end digital services are more difficult for criminals to attack.”

The minister then pointed to his government’s $1.6 billion spend on digital transformation, $240 million of which will be directed to cyber security.

He has since directed the NSW Audit Office to conduct an investigation into Service NSW’s handling of personal information.

That audit will examine Service NSW’s processes, policies, and governance around data management.

No apology?

Dominello’s initial silence following Service NSW’s incident report – which came four months after the initial public notification – drew the ire of his opposition, with Shadow Minister for Better Public Services, Sophie Cotsis, calling for an apology from the minister.

“If it’s good enough for Mark Zuckerberg and the CEOs of Zoom, Yahoo, Marriott International and British Airways to apologise for data breaches, then Victor Dominello must do the same,” Cotsis said.

“The NSW Auditor-General identified serious cyber security weaknesses in State Government agencies last year, yet this government failed to act.

“Now taxpayers could be forced to foot the bill for this minister’s mismanagement of Service NSW, a hugely important agency that eight million people depend on.”

Indeed, the NSW Audit Office slammed the government for its cyber posture in a report late last year which found a large number of government agencies were deficient in their deployment of the Essential Eight cyber mitigation strategies.

Across the board, agencies were lacking in application whitelisting, patching, their configuration of Microsoft office macros, and multi-factor authentication.

Then in late August, a cybersecurity researcher discovered 54,000 NSW drivers licence images sitting in a misconfigured AWS bucket.