Hacking updates …

RBA, AFP, ATO, AusPost caught up in law firm hack

List of affected government entities finally revealed.

The Reserve Bank of Australia, the Department of the Prime Minister and Cabinet, and the Australian Federal Police are among 62 government entities that had sensitive data stolen during last year’s Russia-linked hack at HWL Ebsworth.

Nine months ago, prominent Russia-linked ransom gang AlphV (also known as Blackcat) took to social platform X(formerly Twitter) – claiming to have stolen four terabytes of data from Australian law firm HWL Ebsworth.

Given the law firm held tens of millions of dollars of contracts across several government departments and agencies, it wasn’t long before government officials took urgent action to address fears Commonwealth data may have been caught up in the attack.

The Albanese government established a crisis group to respond to the suspected data theft, and while the incident was eventually confirmed to have impacted NDIS participants, the Office of the Australian Information Commissioner, the Fair Work Ombudsman, and certain Defence projects, the public spent the latter half of 2023 largely in the dark over what Commonwealth data had been stolen.

Now, the government has finally revealed the entire list of government entities impacted by the 2023 data breach, including Prime Minister Anthony Albanese’s department itself.

The full list of agencies – provided to Shadow Minister for Cyber Security and Home Affairs, James Paterson, by the Department of Home Affairs – detailed 62 agencies affected by the HWL Ebsworth hack.

The affected agencies include the Department of Home Affairs itself, the Department of the Prime Minister and Cabinet, the Fair Work Ombudsman, Australia Post, the Reserve Bank of Australia, the Australian Federal Police, and the Australian Competition and Consumer Commission.

The government further admits “sensitive information” including legal advice provided to government entities, personal identifiable information (PII) relating to employees or clients of government entities, and details of “issues relating to national security and law enforcement” was exposed in the landmark hack.

Other exposed data includes vulnerable persons information – such as information relating to people with a disability, victims of crime and certain medical information – as well as corporate information relating to clients, contracts and projects.

Despite the severity of the reported data theft, the revelations come well after the initial April 2023 hack.

Paterson – who sought the list of impacted government entities back in October 2023 – told Information Age the belated turn-around was “concerning”.

“Only the Albanese government can explain why they have kept Australians in the dark for eight months about this very serious and wide ranging breach,” said Paterson.

“Given the sensitivity of the data lost, it is concerning that it is taking so long to get to the bottom of what was lost and to inform the affected parties.

“Australians are entitled to expect better from the federal government, particularly when they hand over such sensitive data to third party organisations like a law firm.

“It is incumbent on the government to ensure when they do so that sufficiently robust cyber security measures are in place to protect it.”

In its response to Paterson, the government emphasised that inclusion on the list “does not imply equal impact” across the detailed entities, and that “varying degrees of impact were observed” in both volume and sensitivity of records exposed.

A spokesperson for Australia Post – one of the entities appearing on the list – told Information Age it “experienced very limited exposure, with no customer data compromised”, while other entities are still working to determine the full impact.

“Some Australian Government entities are still working with HWL Ebsworth to understand the impact to their organisations’ information,” reads the government response.

In total, the AlphV ransomware gang behind the attack stole some 2.5 million documents from the law firm – one million of which were eventually posted online.

Recently, AlphV came to heads with multiple international law enforcement agencies – including the AFP – with the Federal Bureau of Investigation (FBI) boasting it hacked the group’s computer network and distributed some of its decryption keys to victims.

The full list of government entities deemed to have been impacted by the HWL Ebsworth breach:

1. Aged Care Quality and Safety Commission

2. AgriFutures Australia

3. Airservices Australia

4. Australian Broadcasting Corporation

5. Australian Commission for Law Enforcement Integrity

6. Australian Communications and Media Authority

7. Australian Competition and Consumer Commission

8. Australian Criminal Intelligence Commission

9. Australian Curriculum, Assessment and Reporting Authority (ACARA)

10. Australian Digital Health Agency

11. Australian Electoral Commission

12. Australian Federal Police

13. Australian Financial Security Authority

14. Australian Institute of Health and Welfare

15. Australian National University

16. Australian Pesticides and Veterinary Medicines Authority

17. Australian Postal Corporation

18. Australian Securities and Investment Commission

19. Australian Taxation Office

20. Civil Aviation Safety Authority

21. Comcare

22. Commonwealth Grants Commission

23. CSIRO

24. Defence Housing Australia

25. Defence Portfolio

26. Department of Agriculture, Fisheries and Forestry

27. Department of Climate Change, Energy, the Environment and Water

28. Department of Education

29. Department of Employment and Workplace Relations

30. Department of Finance

31. Department of Foreign Affairs and Trade

32. Department of Health and Aged Care

33. Department of Home Affairs

34. Department of Industry, Science and Resources

35. Department of Infrastructure

36. Department of Parliamentary Services

37. Department of Social Services

38. Department of the Prime Minister and Cabinet

39. Department of The Treasury

40. Department of Veterans Affairs

41. Digital Transformation Agency

42. Export Finance Australia

43. Fair Work Ombudsman

44. Geoscience Australia

45. Grains Research and Development Corporation

46. Hearing Australia

47. IP Australia

48. National Disability Insurance Agency

49. National Gallery of Australia

50. National Indigenous Australians Agency

51. National Transport Commission

52. NDIS Quality and Safeguards Commission

53. Northern Australia Infrastructure Facility

54. Office of Chemical Safety (AICIS)

55. Office of Parliamentary Counsel

56. Office of the Australian Information Commissioner

57. Organ and Tissue Authority

58. Regional Investment Corporation

59. Reserve Bank of Australia

60. Services Australia

61. Torres Strait Regional Authority

62. WSA Co Limited

LEONARD BERNARDONE

Leonard Bernardone is an award-winning techie and writer based in Melbourne. After six years working across multiple startup businesses, Leonard now works as a freelance journalist. His work strives to spread awareness, cyber safety, and technical innovation.

Paper trail ends in jail time for 1 013 money mules

Tether Cryptocurrency Becoming ‘Preferred Choice’ Among Money Launderers And Scammers, UN Warns

ANZ steps up money mule fight

A handful of Australian banks are becoming the destination of choice for criminal groups seeking to move money, with ANZ warning its new systems had picked up 3200 accounts linked to suspicious activity. 

ANZ’s head of customer protection Shaq Johnson said the bank was growing concerned its efforts to stamp out mule accounts was leading to criminal groups setting up at other banks. 

Mr Johnson said ANZ was concerned criminal groups behind scams, frauds and money laundering were migrating to other banks with lax know-your-customer requirements and little monitoring of accounts.

“Their controls are not as mature as other banks,” Mr Johnson said. “Those banks are almost becoming the banks of choice for scammers and their accounts get targeted heavily and we see that.” 

Money mules are used by criminal groups to receive stolen funds from frauds or scams, or deposit cash from organised crime, using otherwise “clean” accounts to minimise individual transaction sizes and avoid law enforcement scrutiny. 

Mr Johnson said shutting down mule accounts and identifying who was using them was key to stopping the scams. 

“We fundamentally believe that us tackling this problem will be a cornerstone of being able to fight scams and other financial crimes,” he said. 

The growing problem of financial scams has been impossible to ignore.

The government has poured funds into setting up a National Anti-Scam Centre, while the banking industry also signed a landmark co-operation deal in a bid to deal with the problem. 

The National Anti-Scam Centre warned in November that Australians had lost more than $114m to scams between just July and September. 

In November the Australian Banking Association and the Customer Owned Banking Association both inked a deal with government backing to develop a suite of tools to stamp out scams and frauds, including measures which would stop the use of mule accounts. 

Banks will be required to adopt controls to prevent identity fraud and adopt at least one biometric check for new customers opening accounts online by the end of 2024. 

Assistant Treasurer Stephen Jones said the government was considering imposing penalties on banks that failed to combat mule accounts, but for now was concentrating on raising standards within the industry. 

“We’re giving them the tools they need … then we’ll look at whether we need to extend that,” he said. 

Mr Jones said the government would also look at imposing new rules on companies, including superannuation funds or cryptocurrency platforms, that failed to adopt more stringent customer verification systems.

“We want to ensure that we have a high bar, we don’t want to be seeing institutions used as vectors for criminal activity,” he said.

ANZ revealed at its annual meeting in December that it had invested in new mule detection technology in a bid to stop the misuse of customer accounts. 

Chief executive Shayne Elliot told investors the bank had run a pilot, using artificial intelligence, to identify suspected mule accounts being used in frauds, scams, money laundering and other financial crimes. 

Mr Johnson said ANZ’s pilot picked up 1400 high risk accounts. This was in addition to the almost 3200 ANZ mule accounts identified by the bank between October and December after going live with its account monitoring platform. 

ANZ head of customer protection Shaq Johnson. Picture: Eser Koch

Mr Johnson said the bank was aware of many mules being paid by criminal groups to set up bank accounts for the express purposes of receiving funds, as well as those who sell access to their accounts when leaving the country. 

He also said many mules were recruited through fake job schemes, offering working from home administration roles which involved moving money between accounts. 

Mr Johnson said identifying mule accounts allowed the bank to gain visibility of other mule accounts being used in a web to wash transactions through the banking system. 

“There are certain characteristics that are common, that helps us link the dots,” he said. 

Mr Johnson said the bank would refer mule accounts to police, but did give a first and final warning to those it believed may be unclear of their wrongdoing before closing their accounts. 

“If they do this again, we terminate and report to the police,” he said. 

ANZ had several wins after going live in October with its mule detection systems, picking up multimillion-dollar transactions after scammers redirected legitimate business transactions by providing false account details. 

Mr Johnson said a $4m transaction led ANZ to 37 other mule accounts being used by criminal networks. 

Many mule accounts ultimately led to “high risk destinations”, with criminal groups using offshore banks or crypto products to launder money and export their ill-gotten gains. 

ANZ’s efforts to stamp out mule accounts comes after it stepped up customer onboarding systems in 2020 by adding biometrics capabilities. 

Mr Johnson said the bank had grown concerned about criminal groups buying personal data in bulk to open accounts. In response the bank introduced systems that flagged suspicious behaviour. 

Criminal groups responded to these controls by aggressively recruiting money mules to allow access to existing bank accounts. 

ANZ has also introduced delays for mule accounts it believes may be used by scammers in a bid to allow time to report scams. 

Mr Johnson said ANZ’s actions have “helped us become less of a bank of choice for criminals”.

Australian Federal Police

Seven syndicate members charged for allegedly laundering almost $229 million

26 Oct 2023

Australian Federal Police

Organised crime syndicates significantly disrupted by AFP Eastern Command operations

2 weeks ago

AFR

AFP seized $1.1 billion in assets as part of Operation Avarus-Nightwolf include 14 rentals in Victoria, Queensland and ...

1 month ago

ABC

Australian Federal Police raids target alleged money laundering by Changjiang Currency Exchange

25 Oct 2023

Australian Federal Police

Eighteen Australians arrested, millions in stolen cash returned to victims in international money mule sting

1 month ago

Australian Federal Police

Man sentenced for dealing with $3.6 million in suspected criminal proceeds

1 month ago

Australian Federal Police

Man sentenced for dealing with $8 million in suspected criminal proceeds

1 month ago

Australian Federal Police

Melbourne man charged for helping launder tens of millions from cybercrime victims

26 Oct 2023

Australian Federal Police

Organised Crime Squad charge seven people, as international money laundering syndicate is dismantled

21 Oct 2023

Australian Federal Police

Southern Command Success: 2023 Wrap

3 weeks ago