Notifiable Data Breaches Report: January to June 2023

Large-scale data breaches

The OAIC continues to be notified of breaches that affect a large number of Australians.

In the first half of 2023, there were 23 breaches that affected over 5,000 Australians, compared with 42 in the previous period – a 45% decrease. The OAIC considers the decline reflects the overall (16%) decrease in the number of notifications received this period.

While there was a decrease in the number of breaches that affected over 5,000 Australians, 2 of the breaches reported in this period affected more than 1 million Australians and one affected more than 10 million. This is the first breach notified under the NDB scheme to affect more than 10 million Australians.

Table 2: Number of Australians affected by breaches

Cyber incidents were the cause of a significant proportion of large-scale breaches reported to the OAIC. Twenty-one of the 23 breaches that affected over 5,000 Australians in this period were caused by cyber incidents. Of these, 7 were caused by ransomware, 7 by compromised or stolen credentials (method unknown), 4 by hacking and 1 each by brute-force attack, malware and phishing (compromised credentials).

The remaining 2 breaches that affected over 5,000 Australians in this period were caused by a rogue employee or insider threat and theft of paperwork or a data storage device.

It is vital that entities continue to take appropriate and proactive steps to protect against and respond to a range of cyber threats.

The Australian Cyber Security Centre considers the most effective way to defend against cyber threats is to implement the Essential Eight cyber security strategies.

The OAIC has published guidance on securing personal information and data breach preparation and response to assist entities to protect their information against cyber threats.

Privacy by design to prevent and detect data breaches

Entities should have processes and systems in place to proactively identify and manage privacy risks and security vulnerabilities. Even minor risks and vulnerabilities can result in serious data breaches and undermine community trust in entities.

Human error was the cause of 26% of breaches this reporting period. There is often an element of human error in data breaches predominantly caused by malicious or criminal attacks and system faults. For example:

• Ransomware attacks are often preceded by a successful phishing attack on one or more individual(s) whose compromised credentials are then leveraged by a threat actor.
• Some system faults occur because relevant programming or settings for a device or software program were improperly set or insufficiently tested.

Entities should assume human error will occur and design for it. The OAIC encourages entities to embed good privacy practices into all aspects of their functions and activities. This includes designing systems and processes that anticipate and minimise the risk of human error.

Conducting reasonable and expeditious assessments by being flexible and adaptive

Entities are required to undertake a reasonable and expeditious assessment of a suspected eligible data breach and take all reasonable steps to complete the assessment within 30 days (s 26WH).

The OAIC expects the amount of time and effort entities expend on an assessment is proportionate to the likelihood that an eligible data breach has occurred and its apparent severity.

This period, 26% of entities took more than 30 days to notify the OAIC of data breaches. The OAIC has observed this delay in notification may be due to some entities adopting a fixed‑method or sequential approach to assessing and responding to data breaches. Examples include when an entity:

• assesses whether there are reasonable grounds to believe an eligible data breach has occurred only after completing a forensic investigation, rather than doing the assessment and investigation at the same time
• conducts iterative and increasingly complex and technical reviews of the data involved to identify exactly what occurred and who was impacted, when the apparent severity of the breach and the volume of data is clear.

Generally, the steps in response to any data breach should be taken simultaneously or in quick succession. Entities should also consider whether all the steps are necessary, if any can be combined, or if they need to be re-ordered to ensure the most reasonable and prompt assessment outcome.

Scenario 1

An entity was compromised by a ransomware attack, which resulted in the encryption of data containing personal information. The entity commenced a forensic investigation that identified the root cause was a phishing email, and data was successfully exfiltrated by the threat actor.

Upon conclusion of the forensic investigation, the entity commenced cross-checking and validation exercises to identify exactly what personal information had been exfiltrated. The entity undertook the forensic investigation and assessment sequentially rather than in parallel, which delayed the notification to affected individuals by 5 months, increasing their risk of harm.

Scenario 2

An entity became aware of unauthorised access to its IT system. The entity commenced a forensic IT investigation and data review, which concluded that an eligible data breach had occurred.

The entity took steps to contain the breach and notified affected individuals as soon as practicable to reduce the risk of serious harm. As the entity undertook an investigation of the data breach and its assessment under the NDB scheme in parallel, it was able to quickly identify there were reasonable grounds to believe an eligible data breach had occurred. This enabled it to promptly determine the kinds of personal information involved and to notify affected individuals within 20 days of becoming aware of the breach.

Preventing risks arising from working in changed environments

Working environments have evolved over the last three years, including an increase in remote and hybrid work.

The OAIC has guidance to assist entities to assess privacy risks in changed working environments. Entities are strongly encouraged to conduct a privacy impact assessment and address identified risks arising from their employees’ and contractors’ work environments. This may include consideration of:

• how ‘security aware’ employees and contractors are and whether training or other measures to improve capability and understanding are needed
• remote working policies and procedures and whether these clearly address a range of relevant matters, including physical security and access security
• the risks and benefits of ‘bring your own device’ (BYOD) for employees, requiring exclusive use of entity issued and managed devices for work or a combination of both
• processes and policies in place to enforce regular password updates, minimum password complexity requirements and mandatory multi-factor authentication for all employees and contractors.

Scenario

An entity experienced a cyber incident where personal and commercially sensitive information was stolen. This occurred because a threat actor leveraged a security vulnerability on an employee’s BYOD to obtain their work credentials and remotely login to the entity’s systems at the same time as the employee.

As a result, the threat actor also appeared to be a genuine user and their activities, including unauthorised access to personal information, went undetected until after the data theft.

In this circumstance, the likelihood of the threat actor accessing the information may have been reduced had the entity proactively enforced strong encryption on sensitive personal information, enforced multi-factor authentication and either issued a company device or required minimum security requirements on the employee’s BYOD.

Entities that permit BYOD should review their IT security policy to ensure it addresses risks arising from BYOD and that they educate their employees on how to securely use BYOD to prevent data breaches of work systems.

Remaining vigilant to social engineering and impersonation

Nearly 1 in 5 data breaches in the first half of 2023 were caused by social engineering or impersonation.

The increased incidence of large-scale data breaches in the previous year elevates the likelihood of a mosaic effect, which is when separate pieces of information become significant when combined with other types of information. For example, millions of individuals’ personal information might be collated or aggregated from multiple sources, including the dark web, to build a more complete understanding or new insight into specific individuals or a group of individuals.

With this capability and knowledge in hand, threat actors are more capable of:

• impersonating many different individuals, gaining trust and bypassing existing authentication measures to access accounts
• accessing multiple systems and accounts using compromised credentials, particularly where employees or individuals have reused the same password – or a predictable pattern of passwords – to commit credential stuffing attacks and access accounts.

The OAIC strongly encourages all entities to review and strengthen their access security and ICT security measures, including identity management and authentication.

Entities should also actively foster a security and privacy-aware culture to ensure staff are well‑equipped to identify and respond to fraud and credential stuffing attacks, and so customers know what to do if they are concerned they may have been the subject of an attack.

The scenarios below demonstrate the importance of proactively implementing strong and multiple forms of identity management and authentication, and taking reasonable steps to ensure information is accessed only by authorised persons.

Scenario 1

A retail entity’s customer portal was subjected to a credential stuffing attack, resulting in unauthorised access to 500 customer accounts, which included identity information. At the time of the incident, the entity’s identity authentication for customer accounts was limited to email address and password.

Following an investigation, the entity formed a suspicion that the customers’ credentials were obtained in a data breach of another entity and that the threat actor(s) leveraged this information to bypass their identity authentication measures.

The entity notified all affected customers of the data breach and uplifted its identity authentication measures to include mandatory multi-factor authentication for all customers.

Scenario 2

An entity that facilitates access to health services via a digital platform experienced a data breach in which a threat actor registered with the platform using the genuine professional registration details of a health services provider. The threat actor then impersonated a health service provider and accepted appointments from individuals, gaining access to their personal and sensitive information.

The entity became suspicious after receiving complaints from individuals and conducted an investigation, resulting in identification of the fraud registration and removal of the threat actor’s access to the platform.

The entity notified affected individuals and implemented more stringent identity verification measures for registering healthcare providers on its platform.

Assessing breaches with limited or no evidence

Data breaches caused by cyber security incidents are often complex and generally tend to affect more individuals than other types of malicious or criminal attacks.

It is imperative that entities have effective measures in place to detect, prevent and respond to cyber incidents. This includes having an up-to-date data breach response plan and appropriate audit and logging capabilities so entities can quickly undertake a meaningful and informed assessment of a data breach.

In the July to December 2022 report, the OAIC cautioned entities against relying on the presumed motivations of threat actors and absence of evidence of unauthorised access when assessing cyber incidents. Reliance on these factors can adversely affect the accuracy of a data breach assessment.

The OAIC also encourages entities to:

• Take a cautious approach. If an entity suspects a data breach has occurred but is unable to eliminate that suspicion quickly and confidently, the entity should consider proceeding on the presumption that there has been a data breach. Notification obligations are triggered once there are reasonable grounds to believe that an eligible data breach has occurred. Conclusive or positive evidence of unauthorised access, disclosure or loss is not required for an entity to assess that an eligible data breach has occurred.
• Consider all relevant factors and risks of harm. Entities need to assess a range of relevant factors, when assessing the likelihood of serious harm (s 26WG). Given the objective of the scheme is to promote notification, entities’ assessments should weigh in favour of notifying the OAIC and affected individuals.
• Focus on unauthorised access. Given the clear risks posed by exfiltration, the OAIC appreciates that initial priority may be given to assessing exfiltrated data and notifying individuals to whom it relates. However, an eligible data breach can occur based on unauthorised access alone and individuals’ data can be stolen by less traceable means, such as screenshots. Therefore, entities should not rely on data exfiltration as the determinative factor for deciding whether an eligible data breach has occurred. Entities need to consider all the information that was accessed by a threat actor, or the information that was accessible to them.

The following scenarios are examples of how entities can successfully assess incidents based on the available information, including when there is little or no evidence.

Scenario 1

An entity deployed an update to its customer portal on its website. However, the update contained a bug, which meant individuals who logged in via the portal could see each other’s details.

Within 24 hours of deploying the update, the entity became aware of the bug, contained it and commenced an assessment of whether there were reasonable grounds to believe an eligible data breach had occurred. As part of its assessment, the entity referred to its activity logs and quickly determined 29 individuals who had logged into the portal within the previous 24 hours had been affected by the incident. The entity notified these individuals.

The activity logs enabled the entity to quickly conduct an evidence-based assessment of the data breach and to promptly notify the affected individuals.

Scenario 2

An entity experienced a ransomware attack on one of its servers, resulting in data being exfiltrated by a threat actor(s).

Cyber security specialists conducted a forensic analysis of the incident on the entity’s behalf and determined what specific information was exfiltrated from the server. However, they were unable to determine with certainty what other personal information may have been accessed during the incident.

As the entity was unable to confirm the extent of any unauthorised access, it took a cautious approach and presumed all personal information stored on the server at the time of the incident was potentially accessed by the threat actor(s). As such, the entity notified all potentially affected individuals, enabling them to take steps to reduce their risk of harm.

Data governance to mitigate the effects of data breaches

Over the last year, the OAIC has generally observed an increase in the number of data breaches affecting more than one entity.

Where data breaches affect multiple entities, the OAIC may receive multiple notifications relating to the same incident. Notifications relating to the same incident are counted as a single notification (referred to as the ‘primary notification’) in this report to avoid information being duplicated.

While the overall number of data breaches, including primary notifications, trended downward this reporting period, the average number of secondary notifications increased. Of the 8 primary notifications, 7 were caused by malicious or criminal attacks and involved a service provider relationship. Three were also large-scale data breaches.

Table 6: Comparison of primary and secondary notifications

* Secondary notifications may relate to a primary notification received in a prior period.

There are significant risks with outsourcing the handling of personal information to service providers and contractors. It is important that entities have an information governance framework in place that incorporates the requirements of the Australian Privacy Principles. The information governance framework should cover contractors and service providers that have access to or handle personal information on the entity’s behalf.

The scenario below demonstrates how appropriate information governance can mitigate the effects and severity of a data breach.

Scenario

An entity that provides services to employees and customers (the affected individuals) of other organisations (client organisations) experienced a cyber incident that resulted in the personal information of several thousand individuals being exfiltrated and published on the dark web.

Once aware of the incident, the entity undertook an assessment and identified several client organisations were impacted, some of which were no longer using the entity’s services. This meant the entity needed to consider the data it held about individuals for all client organisations, not just those to which it was still providing services. This resulted in a lengthy and involved assessment process.

In this instance, the complexity and scale of the breach may have been reduced if the entity and client organisations had taken appropriate steps at an earlier time to ensure information was deidentified or destroyed when it was no longer needed.

Effective information governance

The OAIC recommends entities consider the information life cycle and review personal information holdings at least annually to determine:

• What specific personal information is being collected, who is collecting it and whether the collection is necessary. For example, entities should consider sighting identity documents rather than copying and saving them. Information cannot be compromised in a data breach if it was never collected.
• How the personal information is being handled and stored and whether this is occurring in an organised and consistent way. Entities that understand their personal information holdings are better positioned to quickly respond to and assess a data breach.
• What security measures are in place to protect personal information and whether any additional measures are needed. For example, entities should consider whether additional authentication requirements are required to secure systems containing sensitive personal information.
• Whether personal information is still needed and if it should be destroyed or deidentified. Entities with routine retention and destruction policies can substantially reduce the costs and privacy risks associated with holding excess data, including duplicate, low value and historical personal information that may be out of date, inaccurate or misleading.