Senate Finance and Public Administration Legislation Committee [Part 2], , 3:05:04 to 3:16:54
The committee examines reports of Medicare card data being sold on the dark web and the agency's fraud control monitoring. Officials clarify the distinction between internal system breaches and data compromised through third-party providers.
Topics: Privacy, Public safety, Integrity
Speakers: Senator The Hon Jane Hume, Chris Birrer, Randall Brugeaud, Garrett McDonald, Senator The Hon Katy Gallagher, Claire Roennfeldt, David Hazlehurst, Speaker 17
>> Thank you. Uh Randall Brouau, chief operating officer. Um so Senator in terms of the implementation of the uh recommendations uh they were implemented over the course of 2025 and 2026 as you've heard um I can step you through the months in which each of the recommendations were implemented if that is
>> I'm really interested in the last recommendation that was implemented whether when it was implemented yesum >> when it was completed and whether the >> the complete of that of that recommendation had any implications for the breach that occurred in June that you found out about.
>> So we have the month we will come back to you on notice in terms of the day in the month that that was closed. It was closed in September 26 as you've heard. Uh the specific recommendation uh in question is recommendation 13. Uh actually no uh my colleague has offered the actual day. So it was the 10th of September.
>> The 10th of September. When did you find out about the bridge?
>> The I think it's the 11th.
>> So you literally finished the last implementation >> the day before >> and then there was a
>> they were not connected and I I don't believe it would have changed anything.
>> So technology >> and and the final recommendation just um uh for clarity was recommendation 13. Um and the commit commitment that we'd made was to update our protective security plan to incorporate specific guidance on continuous monitoring and improvement reporting. So it was protective security plan update.
>> And it wasn't that it was effective from that date either. That's the date where we formally closed it. So the activity had occurred well before then.
>> Can I just be very clear about what that ANAO report said? It didn't say as I'm sorry I can't see your names as um
>> CLA sorry
>> I couldn't see your names forgive me and I haven't got good enough eyesight at this time of the night um I think you said that the ANA reports said that the system was largely effective it didn't said it was partly effective that's a negative audit that's a negative review as opposed to largely effective which would be a positive review um was Services Australia aware of the implications of receiving a review that said that systems were um partly
>> So, Senator, it's not uncommon for um uh audits to find uh an agency to be partially effective.
But, uh there were two reviews, not one that said this. And I would have thought if there was a review that said that systems were partly effective and had a negative finding, there would have been some more urgency attached to implementing the recommendations.
>> In terms of the second um uh um performance audit that you're referring to, I assume uh Senator to just confirm uh it was the managing the privacy of client information. >> Is that correct?
>> I'm sorry. I don't know. I was hoping
>> there was two audits. One was the management of cyber security incidents the earlier one in 2024 and the second one was the managing of privacy of client information in service Australia which was the later one. >> This did not relate to a privacy breach. The incident that occurred was not a
privacy breach. No, but that's because of the data that was could have been accessed. If if any data had been accessed that was not public, then it would have
>> but there was nothing on the system that it would have been able to do that. It was a data breach, but it was reported um it didn't meet the threshold for the um office of information commissioner in relation to a a privacy breach because I think you checked that. Well, let me
direct you then that second report that has now been fully implemented. Both of those reports that both had a partly effective >> um finding have both now been fully implemented.
>> So for the second um uh report that included eight recommendations, five of which were assigned to services Australia. uh we've implemented and formally closed one uh recommendation and the four remaining recommendations are on track and expected to be implemented by the end of uh this calendar year in line with the expectations of the ANR.
>> Right. So it hasn't been fully implemented yet.
But important to note, Senator, is that the second um uh performance audit had no relation to the cyber security
>> Sorry, can you say that again?
>> Um the second uh performance audit had no relationship to the um cyber security
incident. It would have though had it have been accessing information that was not publicly
available. >> It didn't. It didn't. And it and as um you've been taken through the evidence tonight, if it was trying to get into one of those systems, you know, it wouldn't have it wouldn't have been able to access one of our systems.
>> So, do we call it a hack? I mean, was if is it a hack or not a hack? If it didn't take anything and it just accessed a
all been considered as part of the rapid review that PMNC are leading.
>> Right. Okay. All right. Does service Australia monitor dark web activity? What do you do? sorry I probably should have given that some context. There was a report in the financial review on the 6th of October that there was a services Australia investigation into the dark web and a claim of 25 million Medicare files for sale.
>> Yeah.
>> Is that correct?
>> Uh Garrett McDonald, chief information security officer. Yeah. >> Uh within the cyber security division, uh we work with a range of intelligence I won't, you know, for operational security reasons, it's best if I not speak to the specific nature of the various uh intelligence feeds and capabilities that we do utilize.
Uh I'm not entirely sure whether that is an adequate response here. The suspected cyber secrim criminal posted a sample data set of 38 files containing full names, purported Medicare numbers, expiry dates, dates of birth, email addresses, mobile numbers, and home addresses. Is that correct?
>> We became aware [clears throat] of the uh report of the alleged sale or data for sale on the dark web and the agency uh investigated that. I think uh the fraud control and investigation division uh took the lead on running that matter to ground. So I'll hand over to my colleagues as soon as they settle in. So just while they set up we have combined capabilities where we have an intersection between cyber security as well as fraud control and this one existed at the intersection. We became aware of a report and we handed it over.
Hi, Senator. Uh, Chris Ber, the deputy CEO for payments and integrity group. Uh, as a result of what um, Mr. McDonald just said, we we undertook some sampling activity of the data and, uh, found that it it wasn't actually sort of valid or or upto-date information. It's not uncommon for for people to attempt to sell information which actually has uh no actual veracity to it.
>> So it was just a nonsense was it? Can you explain I know you said that that well the response was that the information was mismatched but are the individual details that are correct? I mean of you know the names all the dates of birth right but they don't match the right Medicare number or
>> there's all that type of thing in there including sort of um um outofdate Medicare cards because of course only last 5 years and from memory too uh that actual set of data was for sale for quite a small amount of money which is also indication that it's often not um >> not not a legitimate sort of um data set.
>> Okay. So then did did the breach create a security issue for service users of Medicare or is the service Australia deemed that the information was useless and incorrect?
>> No, we don't we didn't deem that to be to be at risk of our to our systems. Senator,
okay.
It's not uncommon to see uh sets of data posted for sale on the dark web claiming to be agency data, but they're simply an aggregation of other data that is being collected as as a result of spills that have occurred to private organizations around the world.
>> So, could you do an assessment of whether there was accurate data there that even if it didn't come from you?
>> Well, we do that. Senator. >> Yeah.
>> Yeah.
>> And and and we do that on a regular basis, Senator. We There's two sources of information that we're looking out for when it comes to these sorts of sets of data. One is where a third party organization has been breached.
>> Yeah.
>> And we see uh those medical providers are a good example in this space. their data for sale on the dark web which can include agency credentials like Medicare card numbers. And then secondly, of course, is scam activities where people um are attempting to trick members of the public into providing their loon information. and they're the the pieces of information which are of most concern in terms of us being able to help protect people's um private information in their central link or Medicare accounts.
>> So it might not necessarily have been a breach of your systems, I can understand that. But the fact that this data is out there and being sold, is that a risk to any Australians? Is there enough data out there that was genuine >> rather than mismatched that would mean that there's Australians whose data is at risk?
>> Well, there's there's a risk uh economywide in terms of data out there.
The same relation for this particular incident for the data that you
>> Well, not in this instance. We didn't assess that to be a risk senator, but we're constantly on the lookout for data that's out there.
>> Right. I was going to ask you about that, too. So that's what where I began. Do you monitor the dark web or whatever it is to see what data is out there and whether it has come from you?
>> Yeah, we do.
>> Pen Timson, general manager, fraud control investigations division. Uh, absolutely, Senator. The team works with uh Garrett's division, but we certainly work on the dark web with our partner agencies to monitor and look at what's occurring. Uh and obviously ensure that for uh customers, if we see something that might look like a breach, uh if if they're trying to sell something, we check against our systems to see if that's actually legitimate. We obviously don't publicize that for security reasons, and we certainly don't tell people on the dark web that it's fake.