Add Category
The Department of Defence is continuing to examine personnel data from 2018, which could have been compromised as part of a hack on an external information technology provider.
- It is believed hackers accessed ForceNet service, which is run by an external provider
- The Department of Defence was told no data appeared to be compromised, but a source believes private details may have been accessed
- Defence is seeking to confirm how many personnel's details were in the 2018 dataset caught up in the hack
Hackers have thought to have accessed ForceNet service — which is run by an external information and communications technology (ICT) provider — with the company initially telling Defence no data of current or former personnel appeared to have been compromised.
A source with knowledge of the investigation has since told the ABC that Defence believed some private details — such as dates of birth and dates of enlisting — might have been stolen, despite early indications to the contrary from the external provider.
ForceNet holds the records of up to 40,000 current and former defence employees.
Defence is seeking to confirm how many Defence and Australian Public Service (APS) personnel's details were included in the 2018 dataset that was caught up in the hack.
"This is not an attack on Defence ICT or the ForceNet application," a Defence spokesperson said.
"Defence is taking this matter very seriously and is working with the provider to determine the extent of the attack."
There has been a spate of cyber attacks in recent weeks, from telecommunication companies to health insurers.
Medibank last week confirmed a criminal entity behind the cyber attack on the company had access to the data of at least 4 million customers, some of which included health claims.
A month earlier, Optus announced a cyber attack had exposed the data of almost 10 million Australians, with significant amounts of data stolen from 2.8 million people.
Minister for Defence Personnel Matt Keogh said current and former Defence members — who have had a ForceNet account dating back to 2018 — should be on alert.
"We haven't seen any evidence of that information being made available to anyone as a result of that attack," he said.
"We just want to make sure that all Defence staff and personnel remain vigilant, and we're working with that external contractor now to make sure we get the best picture of what has occurred so that they've got the best support to ensure the security of their systems as well."
Assistant Minister for Defence Matt Thistlethwaite said the department was contacting ADF members.
"They're suggesting considering changing passwords and moving to two-factor authentication and the like but, importantly, the aim will be to support ADF personnel," he said.