The Tasmanian Department of Education, Children, and Young People experienced a cyber attack where hackers targeted and breached the third-party file transfer service GoAnywhere MFT.
The breach took place last month and the state government confirmed on March 31 that its data had been accessed. Despite applying a patch to fix vulnerabilities, the government continues to use the software as part of "best practice."
The breach lasted for four days, during which information was transferred.
As a result, documents including invoices, bank statements, and personal information of individuals connected to the department were accessed by the ransomware group Cl0p. Investigations are ongoing, and there may be more affected documents.
Tasmanian schools have been notified, and a hotline (1800 567 567) has been established for individuals to report any concerns about their data.
Additionally, 16,000 Tasmanian education department documents, including personal information of school children, were released on the dark web by hackers. Science and Technology Minister Madeleine Ogilvie confirmed the breach, revealing that financial statements and invoices containing names and addresses of students and parents were accessed.
Ms. Ogilvie expressed concern for affected students and parents, urging them to report any unusual activity on their bank statements to authorities, such as the Australian Cybersecurity Centre or the provided hotline. She acknowledged the global nature of cybercrime and expressed sympathy for those whose data was released.
According to the data, Crown Resorts and Rio Tinto are also believed to be victims of the same cyber attack. Labor's Jen Butler called on the premier to manage the crisis, as potentially every primary school in Tasmania and anyone associated with the Department of Education may be compromised, posing a risk.
Other organizations, including Rio Tinto, have been contacted for ransom by the same Russian hackers. Labor leader Rebecca White has requested a briefing from the government, acknowledging the seriousness of the situation and parental concerns.
Furthermore, Ogilvie confirmed that as of now the demands for ransom have not been made by the hackers. However, the federal government advises against paying any ransom if demanded. Earlier, the state opposition urged Tasmanian Premier Jeremy Rockliff to intervene and address the escalating situation.
The ransomware group known as "CL0P" is believed to be a Russian-language cybercriminal gang responsible for notorious "big game hunter" ransomware attacks since at least 2019. They have been associated with other cybercriminal groups such as 'FIN11' and 'UNC2546'. CL0P follows the common tactic of stealing, encrypting, and leaking data, and victims who fail to meet their ransom demands are publicly named and shamed on their leak site called "CL0P LEAKS" hosted on Tor.
