A quarter of cyber incidents reported to Australian security officials over the past year have targeted critical infrastructure and essential services, including health care, food distribution and energy.
The Australian Cyber Security Centre (ACSC) disclosed the incidents in a report published yesterday, warning of “significant targeting, both domestically and globally, of essential services.”
These incidents have “underscored the vulnerability of critical infrastructure to significant disruption in essential services, lost revenue and the potential of harm or loss of life.”
Photo: Bloomberg
The report will also show ransomware attacks disclosed to the ACSC increased 15 percent in the 2020-21 financial year, when compared with the previous financial year.
The ACSC — which is part of the Australian Signals Directorate — received more than 67,500 reports of cybercrime of all types in 2020-21, or one every eight minutes.
That compared with one every 10 minutes the previous year.
Photo: AP
HUGE LOSSES
The report says businesses, individuals and other entities had incurred more than US$33 billion in total losses from cyber crime throughout the year.
Cybercriminals sought to exploit the pandemic by encouraging recipients to enter personal credentials to access COVID-related information or services, while unnamed foreign governments targeted the health sector seeking “access to intellectual property or sensitive information about Australia’s response to COVID.”
Photo: AFP
The ACSC responded to about 1,630 cybersecurity incidents in 2020-21, or an average of 31 cybersecurity incidents a week.
“Approximately one quarter of reported cybersecurity incidents affected critical infrastructure organizations, including essential services such as education, health, communications, electricity, water and transport,” the report says.
A breakdown of the severity of cyber incidents in 2020-21 shows there were 14 cases in which federal government entities or nationally significant infrastructure suffered the removal or damage of sensitive data or intellectual property.
This category also includes the supply chain to critical national infrastructure. Those entities also suffered a further 44 incidents in which there was an active network intrusion or temporary disruption to systems or services.
The report does not name most of the affected entities, although it includes several case studies, including a March 2021 ransomware attack against a Victorian public health service. That attack “affected four hospitals and aged care facilities, and resulted in the postponement of elective surgeries.”
The assistant defense minister, Andrew Hastie, who released the report, said malicious cyber criminals were “escalating their attacks on Australians”.
Hastie said the health sector reported the second highest number of ransomware incidents, “right at a time when Australians are most reliant on our health workers to help us respond and recover through the pandemic.”
He pointed to a government bill — which remains before the parliament, and has attracted concerns from industry about regulatory impact — that would impose mandatory cyber incident reporting requirements on organizations that run critical infrastructure assets.
Hastie said the legislation would “ensure that in the event of a large-scale cyber attack on our critical infrastructure, our cyber and law enforcement agencies are empowered to provide greater and more immediate support to the victims.”
In ransomware attacks, criminals typically lock up the data of a target organization and then demand payment to decrypt and unlock systems, sometimes threatening to leak stolen data if the request is rebuffed.
The ACSC report mentions the ransomware attack on the global meat and food processing company JBS Foods in May 2021, which led to the suspension of operations and standing down of workers in Australia.
The US division later confirmed that it had paid a ransom equivalent to US$11 million — reportedly in bitcoin.
With nearly 500 ransomware cybercrime reports in the 2020-21 financial year, the ACSC says the problem has “grown in profile and impact, and poses one of the most significant threats to Australian organizations.”
“This increase has been associated with an increasing willingness of criminals to extort money from particularly vulnerable and critical elements of society.”
The report says ransom demands by cybercriminals ranged from thousands to millions of dollars, and attackers have improved their capabilities by accessing tools and services on the dark web.
The report says “new and serious concerns” have joined the list of existing cyber threats, such as “the protection of Australia’s COVID-19 vaccine supply, including distribution processes, from malicious cyber actors.”
STATE-BASED ACTORS
State-based actors are believed to have an interest in learning more about Australia’s pandemic response and the views of those providing advice to government.
“State and criminal cyber actors alike possess the capability to disrupt Australia’s critical infrastructure — including vaccine supply and distribution chains — with the pandemic only amplifying the opportunities for these actors to cause Australia harm,” the report says.
“Even in the absence of direct and intentional targeting, there remains the potential for malicious cyber actors to inadvertently disrupt vaccine supply and distribution chains, making the threat more difficult to address.”
The report mentions China once — when summarizing the Australian government’s decision in July to join with the US and other international partners in accusing China’s Ministry of State Security of exploiting vulnerabilities in the Microsoft Exchange software.
That exploit is estimated to have affected thousands of computers and networks worldwide, including in Australia — but the Chinese government said they were “groundless accusations.”
Wednesday’s report also warns that business email compromise — which includes when companies are targeted with fake invoices that appear to be for genuine services — “continues to present a major threat to Australian businesses and government enterprises, especially as more Australians work remotely.”
The average loss in such incidents was more than US$50,600, which the report says is “over one-and-a-half times higher than the previous financial year.” It says cybercriminal groups have become more sophisticated and organized.
Under pressure, President William Lai (賴清德) has enacted his first cabinet reshuffle. Whether it will be enough to staunch the bleeding remains to be seen. Cabinet members in the Executive Yuan almost always end up as sacrificial lambs, especially those appointed early in a president’s term. When presidents are under pressure, the cabinet is reshuffled. This is not unique to any party or president; this is the custom. This is the case in many democracies, especially parliamentary ones. In Taiwan, constitutionally the president presides over the heads of the five branches of government, each of which is confusingly translated as “president”
Sept. 1 to Sept. 7 In 1899, Kozaburo Hirai became the first documented Japanese to wed a Taiwanese under colonial rule. The soldier was partly motivated by the government’s policy of assimilating the Taiwanese population through intermarriage. While his friends and family disapproved and even mocked him, the marriage endured. By 1930, when his story appeared in Tales of Virtuous Deeds in Taiwan, Hirai had settled in his wife’s rural Changhua hometown, farming the land and integrating into local society. Similarly, Aiko Fujii, who married into the prominent Wufeng Lin Family (霧峰林家) in 1927, quickly learned Hoklo (commonly known as Taiwanese) and
The Venice Film Festival kicked off with the world premiere of Paolo Sorrentino’s La Grazia Wednesday night on the Lido. The opening ceremony of the festival also saw Francis Ford Coppola presenting filmmaker Werner Herzog with a lifetime achievement prize. The 82nd edition of the glamorous international film festival is playing host to many Hollywood stars, including George Clooney, Julia Roberts and Dwayne Johnson, and famed auteurs, from Guillermo del Toro to Kathryn Bigelow, who all have films debuting over the next 10 days. The conflict in Gaza has also already been an everpresent topic both outside the festival’s walls, where
The low voter turnout for the referendum on Aug. 23 shows that many Taiwanese are apathetic about nuclear energy, but there are long-term energy stakes involved that the public needs to grasp Taiwan faces an energy trilemma: soaring AI-driven demand, pressure to cut carbon and reliance on fragile fuel imports. But the nuclear referendum on Aug. 23 showed how little this registered with voters, many of whom neither see the long game nor grasp the stakes. Volunteer referendum worker Vivian Chen (陳薇安) put it bluntly: “I’ve seen many people asking what they’re voting for when they arrive to vote. They cast their vote without even doing any research.” Imagine Taiwanese voters invited to a poker table. The bet looked simple — yes or no — yet most never showed. More than two-thirds of those
RSS