Get all your news in one place.
100’s of premium titles.
One app.
Start reading
The Guardian - AU
The Guardian - AU
National
Josh Taylor

Medical test company’s ‘serious and systemic failures’ led to cyber-attack, watchdog says

Laptop with code
OAIC alleges significant failures by ACL to protect customer data from the hack by a group known as Quantum. Photograph: Wietse Michiels/Alamy

Medical testing company Australian Clinical Labs had “serious and systemic failures” that resulted in a cyber-attack that led to more than 200,000 customer health records and credit card details being published on the dark web, the Australian information commissioner has alleged.

In October last year, in the midst of the Medibank and Optus cyber-attacks, Medlab’s parent company, ACL, confirmed it had been the victim of a cyber-attack eight months earlier in February.

The hacker group responsible – known as Quantum – was able to exfiltrate 86GB worth of data, including customer passport information, health information, and credit card details including number, expiry date and CCV.

The data had been published on the dark web on 16 June last year, four months before ACL publicly confirmed the attack.

This month, the Office of the Australian information commissioner (OAIC) took ACL to court over its failure to protect customer data during the breach. The OAIC’s concise statement, released last week, alleges significant failures by the company to protect customer data and inform the commissioner about the breach when required.

According to the documents, within four hours from the time the first employee noticed the ransomware message on a desktop computer in Medlab, it had spread to other computers in Brisbane and Sydney, which were then encrypted by the attackers.

ACL, which generated revenue of almost $1bn during the 2022 financial year, did not have a dedicated cybersecurity team, the documents state. Its response was led by an IT team leader, overseen by ACL’s CIO and head of technical services, but the OAIC alleges none of these staff had formal cybersecurity qualifications or experience in responding to a cyber-attack.

The head of technical services provided the IT team leader with the company’s playbook for ransomware and malware, but the IT team leader had not been trained to use these books, and OAIC alleges critical steps in the playbook were not followed, including analysing the ransomware.

The company then brought in a third-party company, StickmanCyber, to assist in the response. The OAIC found that monitoring agents were only deployed on three of the at least 121 computers infected with ransomware.

StickmanCyber’s short engagement with ACL, including reviewing one hour of firewall logs and dark web scans, concluded at the time no data had been taken.

By 21 March 2022 the IT team leader, after a conversation with the company’s general counsel, sent an email stating “as per information available to the IT department there was no unauthorised access, disclosure, or loss of any personal information … as a result of the incident”. The company did not inform the OAIC about the attack.

On 25 March, the Australian Cyber Security Centre informed ACL it had intelligence that Medlab may be a victim of a ransomware attack, and reminded ACL of its notification requirements. ACL did not investigate further, OAIC alleges.

ACSC alerted ACL again on 16 June that data had been published to the dark web. It would take the company nearly one month (10 July) to inform the OAIC, which OAIC alleges is in breach of the act. ACL would take until October to announce the breach publicly.

The OAIC alleges ACL was “aware of serious deficiencies in its cybersecurity framework” at least nine months before the cyber-attack, and did not take appropriate steps to protect personal information.

The OAIC said the failures were “serious and systemic”, noting that ACL’s IT budget was $1.3m in 2022, with a cybersecurity budget of $350,000 – “significantly lower than that of industry standards”, the OAIC alleges.

The OAIC is seeking civil penalties and costs.

A spokesperson for ACL said the company is “vigorously defending the action”.

The case continues.

The OAIC is still investigating Optus and Medibank over cyber-attacks last year, which could lead to similar court action against the two companies.

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.