The Reserve Bank of Australia, the Department of the Prime Minister and Cabinet, and the Australian Federal Police are among 62 government entities that had sensitive data stolen during last year’s Russia-linked hack at HWL Ebsworth.
Nine months ago, prominent Russia-linked ransom gang AlphV (also known as Blackcat) took to social platform X (formerly Twitter) – claiming to have stolen four terabytes of data from Australian law firm HWL Ebsworth.
Given the law firm held tens of millions of dollars of contracts across several government departments and agencies, it wasn’t long before government officials took urgent action to address fears Commonwealth data may have been caught up in the attack.
The Albanese government established a crisis group to respond to the suspected data theft, and while the incident was eventually confirmed to have impacted NDIS participants, the Office of the Australian Information Commissioner, the Fair Work Ombudsman, and certain Defence projects, the public spent the latter half of 2023 largely in the dark over what Commonwealth data had been stolen.
Now, the government has finally revealed the entire list of government entities impacted by the 2023 data breach, including Prime Minister Anthony Albanese’s department itself.
The full list of agencies – provided to Shadow Minister for Cyber Security and Home Affairs, James Paterson, by the Department of Home Affairs – detailed 62 agencies affected by the HWL Ebsworth hack.
The affected agencies include the Department of Home Affairs itself, the Department of the Prime Minister and Cabinet, the Fair Work Ombudsman, Australia Post, the Reserve Bank of Australia, the Australian Federal Police, and the Australian Competition and Consumer Commission.
The government further admits “sensitive information” including legal advice provided to government entities, personal identifiable information (PII) relating to employees or clients of government entities, and details of “issues relating to national security and law enforcement” was exposed in the landmark hack.
Other exposed data includes vulnerable persons information – such as information relating to people with a disability, victims of crime and certain medical information – as well as corporate information relating to clients, contracts and projects.
Despite the severity of the reported data theft, the revelations come well after the initial April 2023 hack.
Paterson – who sought the list of impacted government entities back in October 2023 – told Information Age the belated turn-around was “concerning”.
“Only the Albanese government can explain why they have kept Australians in the dark for eight months about this very serious and wide ranging breach,” said Paterson.
“Given the sensitivity of the data lost, it is concerning that it is taking so long to get to the bottom of what was lost and to inform the affected parties.
“Australians are entitled to expect better from the federal government, particularly when they hand over such sensitive data to third party organisations like a law firm.
“It is incumbent on the government to ensure when they do so that sufficiently robust cyber security measures are in place to protect it.”
In its response to Paterson, the government emphasised that inclusion on the list “does not imply equal impact” across the detailed entities, and that “varying degrees of impact were observed” in both volume and sensitivity of records exposed.
A spokesperson for Australia Post – one of the entities appearing on the list – told Information Age it “experienced very limited exposure, with no customer data compromised”, while other entities are still working to determine the full impact.
“Some Australian Government entities are still working with HWL Ebsworth to understand the impact to their organisations’ information,” reads the government response.
In total, the AlphV ransomware gang behind the attack stole some 2.5 million documents from the law firm – one million of which were eventually posted online.
Recently, AlphV came to heads with multiple international law enforcement agencies – including the AFP – with the Federal Bureau of Investigation (FBI) boasting it hacked the group’s computer network and distributed some of its decryption keys to victims.
The full list of government entities deemed to have been impacted by the HWL Ebsworth breach:
1. Aged Care Quality and Safety Commission
2. AgriFutures Australia
3. Airservices Australia
4. Australian Broadcasting Corporation
5. Australian Commission for Law Enforcement Integrity
6. Australian Communications and Media Authority
7. Australian Competition and Consumer Commission
8. Australian Criminal Intelligence Commission
9. Australian Curriculum, Assessment and Reporting Authority (ACARA)
10. Australian Digital Health Agency
11. Australian Electoral Commission
12. Australian Federal Police
13. Australian Financial Security Authority
14. Australian Institute of Health and Welfare
15. Australian National University
16. Australian Pesticides and Veterinary Medicines Authority
17. Australian Postal Corporation
18. Australian Securities and Investment Commission
19. Australian Taxation Office
20. Civil Aviation Safety Authority
21. Comcare
22. Commonwealth Grants Commission
23. CSIRO
24. Defence Housing Australia
25. Defence Portfolio
26. Department of Agriculture, Fisheries and Forestry
27. Department of Climate Change, Energy, the Environment and Water
28. Department of Education
29. Department of Employment and Workplace Relations
30. Department of Finance
31. Department of Foreign Affairs and Trade
32. Department of Health and Aged Care
33. Department of Home Affairs
34. Department of Industry, Science and Resources
35. Department of Infrastructure
36. Department of Parliamentary Services
37. Department of Social Services
38. Department of the Prime Minister and Cabinet
39. Department of The Treasury
40. Department of Veterans Affairs
41. Digital Transformation Agency
42. Export Finance Australia
43. Fair Work Ombudsman
44. Geoscience Australia
45. Grains Research and Development Corporation
46. Hearing Australia
47. IP Australia
48. National Disability Insurance Agency
49. National Gallery of Australia
50. National Indigenous Australians Agency
51. National Transport Commission
52. NDIS Quality and Safeguards Commission
53. Northern Australia Infrastructure Facility
54. Office of Chemical Safety (AICIS)
55. Office of Parliamentary Counsel
56. Office of the Australian Information Commissioner
57. Organ and Tissue Authority
58. Regional Investment Corporation
59. Reserve Bank of Australia
60. Services Australia
61. Torres Strait Regional Authority
62. WSA Co Limited
