Notifiable Data Breaches Report: January–June 2020

Between January and June 2020, the OAIC received a number of notifications where it was not clear whether the notifying entity had either undertaken an appropriate assessment of the data breach, or had determined the nature and extent of the breach.

Under the NDB scheme, a data breach is an ’eligible data breach’ where:

• there is unauthorised access to or unauthorised disclosure of personal information (or the information is lost in circumstances where unauthorised access to, or unauthorised disclosure of, the information is likely to occur)
• a reasonable person would conclude it is likely to result in serious harm to any of the individuals whose personal information was involved in the data breach, and
• the entity has not been able to prevent the likelihood of serious harm through remedial action.

If an entity suspects that an eligible data breach has occurred, they must undertake an assessment into the relevant circumstances. This should include whether the breach posed a risk of serious harm to affected individuals, the cause or source of the breach, the type of personal information that was accessed or disclosed, and the number of individuals who were at risk of serious harm as a result of the breach.

If an entity is aware that there are reasonable grounds to believe that there has been an eligible data breach, they must notify affected individuals and the OAIC as soon as practicable. The OAIC’s data breach response flowchart illustrates the steps that should be taken in assessing and responding to an eligible data breach.

Understanding the nature and extent of the breach

The capacity to conduct a timely and thorough assessment and investigation of a suspected data breach can be constrained when an entity does not comprehensively understand its own information environment.

Notifying entities who did not have audit or activity logging enabled on their network or email servers/accounts, or could not undertake retrospective traffic analysis of their internet gateway, had difficulty determining whether a malicious actor who had gained access to their network in a cyber attack had accessed or exported (exfiltrated) personal information.

All entities covered by the Privacy Act should be aware of the personal information they retain within their information and communications technology (ICT) environment and where it is located. Effective ICT security requires protecting both hardware and software from misuse, interference, loss, unauthorised access, modification and disclosure.

If an entity does not have a clear understanding of the types of information it retains and where it stores it, not only will the entity find it difficult to meet its obligations under the NDB scheme if a data breach occurs, it may also be in breach of the requirements of Australian Privacy Principles 1 and 11 (APPs).

There have been multiple instances of incomplete notifications of data breaches where entities may not have fully met their obligations with regard to the content of the notification to individuals affected by a data breach.

For example, while entities notified affected individuals that their email addresses were involved in a data breach, on some occasions they did not advise that other personal information was also involved. This included personal information contained as attachments to emails received and sent from the compromised account, or in the cloud storage associated with the account.

Multiple notifications failed to include recommendations about the steps that individuals should take in response to the breach.

In these cases, the OAIC required the entity to re-issue the notification to include all the kinds of personal information that was involved, and provide the practical advice required to help individuals reduce the risk of harm.

Example of best notification practice

Entities reporting a data breach are required to provide practical guidance to affected individuals. As a best practice example, an organisation which experienced a data breach involving the financial, contact, identity details and Tax File Numbers (TFNs) of over 1000 people issued a detailed notification that provided:

• a comprehensive summary of the data breach and what the entity had done to contain and remediate the breach
• an itemised summary of all the types of personal information that had been exposed in the data breach
• a number of practical steps that those affected should take in response to the breach, including:
  • guidance on best practice in relation to the use of email and cyber security practices tailored to reflect the heightened risk of targeted spear phishing or fraudulent approaches to individuals affected by the breach
  • specific advice on steps individuals could take to reduce the risk of unauthorised access to bank accounts, credit cards and superannuation accounts
  • recommendations on options for placing credit bans on credit files
  • advice on how to contact Australian Government agencies about breaches of identity information such as Medicare number and TFN.

The OAIC’s website includes practical guidance about steps individuals can take to reduce their risk of harm. When applicable, these steps should be included in notifications to affected individuals.

From January to June 2020, the number of data breach notifications attributed to ransomware attacks increased by more than 150% compared to the previous six months — increasing from 13 to 33.

Ransomware is a strain of malicious software which encrypts the data stored on the affected system, rendering the data either unusable or inaccessible. The malicious actor behind the attack then demands a sum of money be paid for the decryption key. The decryption key may or may not be provided after the ransom is paid.

Ransomware can be installed on a system through a malicious email attachment, a fraudulent software download or by visiting a malicious webpage. Ransomware attackers can also gain access to a system through unsecured public-facing servers or a remote port.

It is possible that the increase in ransomware notifications to the OAIC is the result of entities undertaking more rigorous assessments of ransomware incidents on their networks, resulting in more instances where entities confirm that personal information had been either accessed or copied by the attacker. However, media reporting during the reporting period has highlighted an increase in ransomware attacks that resulted in the copying or exfiltration of data as well as the encryption of the data on the target network. Many of these attacks appear to be linked to a specific ransomware variant.

If data exfiltration, in addition to encryption, becomes the default function of ransomware attacks, this will have significant implications for how entities respond to ransomware attacks. Previously, entities responding to ransomware attacks would look for evidence of access to, or the export of, data before suspecting that an eligible data breach had occurred. Now, given growing evidence that data exfiltration tends to occur when certain ransomware variants are deployed, entities may have grounds to suspect that a ransomware attack constituted an eligible data breach at the time they become aware of the attack.

Ransomware attacks are inherently difficult to assess and investigate because the target entity can no longer access its own network. It can be difficult, time consuming and expensive for an entity to investigate the extent of malicious actor access to its data. The entity will often have to rebuild or recreate its network to understand the extent of the compromise.

It is critical that entities who collect and retain personal information — including the information of clients, customers, business partners, employees and contractors — fully understand how and where this information is stored on their network. They should also consider network segmentation, additional access controls and encryption to reduce the risk of personal or commercial information being exposed by a ransomware attack.

There is increasing public awareness of the threat of ransomware attacks to Australian business, and growing evidence that these attacks often result in the exfiltration and release of information by the attacker. Entities are expected to be aware of their obligations under the NDB scheme and under APP 11.

One of the key objectives of the NDB scheme is to ensure that individuals who are at risk of serious harm as a result of a data breach are notified of the breach and can take steps to reduce the risk of harm.

Two factors affect the timeliness of notification: the time it takes for the entity to identify that the breach has occurred; and the time it takes the entity to complete its assessment of the breach and notify the OAIC and affected individuals.

Across the reporting period approximately 77% of notifying entities were able to identify a breach within 30 days of it occurring.

However, in 47 instances the entity took between 61 and 365 days to become aware that a data breach had occurred, while 14 entities took more than a year.

Almost three-quarters (74%) of notifying entities were able to complete their assessment of the data breach and report it to the OAIC within 30 days of becoming aware that a data breach had potentially occurred. In 63 instances (12% of all notifications) the entity took longer than 60 days to complete their assessment and notify the OAIC, and in 25 instances (5%) took more than 121 days.

There was considerable variation across industries in the time taken to notify the OAIC of an eligible data breach, with 87% of notifications from the health sector and 82% of notifications from the education sector made within 30 days. Only 65% of notifications from the finance sector and 66% of notifications from the insurance sector were made to the OAIC within 30 days of the notifying entity becoming aware of the breach.

The Privacy Act requires entities to carry out an assessment of a data breach within 30 days of becoming aware of reasonable grounds to suspect that there may have been an eligible data breach, and to notify the OAIC and affected individuals as soon as practicable after it confirms that an eligible data breach has occurred.

Where the assessment is not completed within 30 days, the entity must provide the OAIC with an explanation for the delay.

Explanations provided to the OAIC for delays in assessment and notification of data breaches include references to the complexity of an enterprise IT environment, or the significant number of emails and documents stored in a compromised email account.

However, in some instances, these explanations highlighted issues with regard to the entity’s information handling and security practices, which in turn raised questions about broader compliance with APPs 1 and 11 regarding the security of personal information.

Data breaches resulting from phishing continue to be the leading source of malicious attacks.

Where entities used email applications and services for the primary storage of personal information, and the entity experienced a phishing attack, malicious actors either used the compromised email account to carry out further phishing campaigns, or accessed and exploited the personal information held in the inbox.

A number of entities applied additional security measures after experiencing a phishing attack, including:

• training staff in identifying and responding to phishing emails
• implementing multi-factor authentication on email accounts
• resetting credentials on the compromised email accounts and/or the wider network
• reviewing and upgrading existing security measures to include ongoing monitoring and antivirus and malware detection.

Entities should consider reviewing their practices and processes on an ongoing basis, without being prompted by a phishing attack, as part of their obligations under APP 11.

This may include regular staff training on data breaches and privacy obligations, reviewing access security protocols and password policies, and implementing measures to detect and contain unauthorised access to the entity’s personal information holdings.

Entities should also review the types of information that they collect, and how this information is received, stored, secured, and then destroyed or de-identified as required by APP 11.

The OAIC has continued to receive notifications where entities are storing sensitive personal information such as bank account details, superannuation account numbers and TFNs within email accounts. Entities should consider additional security controls when emailing sensitive personal information, such as password-protected or encrypted files. This personal information should then be stored in a secure document management system and the emails deleted from both the inbox and sent box. More information about the steps entities can take to comply with APP 11 can be found in the OAIC’s Guide to securing personal information.