The South Australian government says data belonging to a significant number of people has potentially been accessed through a cyber security breach.
SA Treasurer Stephen Mullighan told parliament on Wednesday that hackers stole data from a call centre previously contracted by Super SA — a dedicated superannuation fund for state government employees.
He said the security breach happened nearly two months ago, but he was only informed of the incident late last week.
“It’s simply not good enough,” he said.
“The way government responds to this needs to improve because it is letting, on these sorts of occasions, thousands — sometimes many thousands — of South Australians down.”
The government is currently investigating whether other agencies which had contracts in place with the same call centre were also caught up in the breach.
In a statement, a government spokesperson said the breach “does not appear to involve any data more recent than 2020”.
“Super SA has notified some members there may be personally identifiable information included in the data, the majority of which may contain a name, address, and date of birth. However, for some members there may be other types of information accessible,” the statement reads.
“The government’s cyber security section has been working with other agencies who have previously used the third party provider, but at this stage there is no advice that any other personal data has been breached.”
Call centre targeted after previous breach
Mr Mullighan said Super SA hired the call centre to help it field phone calls from members impacted by a previous cyber security breach in 2019.
He said the call centre retained Super SA member data after its contract ended, with that data accessed during the latest security breach.
“It is still being investigated why that call centre provider had retained data on its systems relating to managing that particular agency’s client relations task,” Mr Mullighan said.
“That raises… a series of further questions — what requirements are there for these agencies to not continue holding government data on their ICT systems after they complete doing work for government?
“It is absolutely clear that the way in which these incidents have been managed is not good enough because it’s causing the exposure of sensitive South Australians’ data to be expose to illegal access.”
The ABC contacted Super SA for comment.
In a statement to its members, the agency said “a small cohort of members” may have been impacted by the security breach.
“We are taking an abundance of caution to secure member accounts in the acknowledgement that the data has been breached, however, at this stage it is still unknown if any of the Super SA data has been accessed,” the statement said.
Treasurer calls for security improvements
Mr Mullighan said the latest cyber security breach proved government agencies needed to improve their internal security.
“Government agencies need to do a much, much better job at firstly, trying to insulate themselves as best they can against these attacks in the first place, but secondly respond to them in a timely, thorough and appropriate way,” he said.
“I’m not convinced that the response from government agencies, let alone the external third-party provider here, has been timely, has been thorough and has been casting a mind as quickly as it should to the impacts to be borne by people who might be impacted by it.”Mr Mullighan said he would report back to the parliament on how many members had been impacted by the security breach.
