Cyber attack exposes sex health clients, highlights threats to not-for-profits

Family Planning NSW chief executive Professor Ann Brassil made a full apology to its clients and to the general public in a blitz of national media coverage, just months after tough new data breach laws came into affect in February.

The organisation said it had been one of several targeted by cyber-criminals in the Anzac Day attack, in which they threatened to release personal information unless the organisation paid a bitcoin ransom.

While Family Planning NSW had managed to secure its site by 10am the following day, and assured clients, it accepted that many clients would be worried about the safety of their data.

"We became aware of the issue on April 25 and had the site secured by 10am on April 26, 2018. Clients can rest assured all web databases are now secure and there have been no further threats from the cyber criminals. More sensitive medical records held by our organisation and its clinical staff were never under threat," Prof Brassil said.

"We know that some of the clients that we've contacted will be concerned about what it means for them."

She said compromised data included information about clients who had contacted its website over two-and-a-half years, seeking appointments or leaving feedback, but she said there was no indication that the information had been used by the attackers.

It had alerted federal police, set up a dedicated phoneline and email contact point to inform individuals, and continued a "thorough review of our information security to ensure our clients can continue to trust us for their reproductive and sexual health services".

The breach comes just two months after tough new laws came into force that require organisations to report breaches or face hefty fines.

Family Planning NSW hosts more than 28,000 client visits each year across five clinics in NSW that provide advice and services related to a range of reproductive and sexual health services.

The Office of the Australian Information Commissioner (OAIC) confirms that it was notified by Family Planning NSW about the Anzac Day data breach.

It said that the Notifiable Data Breaches (NDB) scheme, which commenced on 22 February 2018, requires organisations to notify affected individuals and the OAIC where there is a likely risk of serious harm to any of the individuals whose personal information is involved in the data breach.

Health orgs, charities in breach top five

The first quarterly report by the OAIC of data breaches has revealed a big spike in reported breaches, with 63 notifications in the first six weeks of mandatory notifications, compared to 114 for all of 2016-2017.

Among the top-five sectors affected include health service providers (24%) and charities (6%). Legal, accounting and management services (16%), finance (13%), and private education (10%) made up the top five sectors in reports.

The OAIC said 51% of data breaches were the result of "human error", while 44% were caused by malicious or criminal attacks. Just 3% were the result of system faults.

And, in an implied warning for smaller organisations - including not-for-profits - 90% of the breaches involved the personal information of less than 1000 individuals.

The OAIC's acting Australian Information Commissioner Angelene Falk said at the release of the quarterly report said notification gave affected individuals the chance to reduce the impact, such as by changing passwords.

'Over time, the quarterly reports of the eligible data breach notifications received by the OAIC will support improved understanding of the trends in eligible data breaches and promote a proactive approach to addressing security risks.

Ms Falk said the high rate of human error "highlights the importance of implementing robust privacy governance alongside a high-standard of security."

"The risk of a data breach can be greatly reduced by implementing practices such as Privacy Impact Assessments, information security risk assessments, and training for any staff responsible for handling personal information."

Our Community's director of technology architecture Lars Jensen said the incident with Family Planning NSW also meant that organisations should consider how long they held data.

"It's important not to keep data longer than you need," Mr Jensen said.

"It appears the hacked website was likely just an appointment booking system, in which case there was probably no need to keep two-and-a-half years' worth of data in there.

"The breach might still have happened even if there was only three months' worth of data there, but several thousand more people would be sleeping easier."

Do overseas privacy controls affect you?

In further compliance expectations for organisations, the European Union has also just added new requirements for organisations.

The rules will come into effect on May 25, 2018, and it could affect any Australian organisations that have connections to Europe.

Legal experts at Moores note that this includes organisations with offices in the EU, offering goods and services - including online, or that tracks the activity of EU individuals.

Cyber risks: Have you acted on new data breach laws?

Australian not-for-profits must comply with new laws that require them to notify authorities if they've had a significant data breach.

The news laws came into effect on February 22, 2018, which means any breaches after that date must be reported.

The law requires not-for-profits with more than $3 million in annual turnover to notify authorities of data breaches.

Organisations face fines of up to $2.1 million for breaches.

Aon insurance's national practice leader for cyber risk, Fergus Brooks, says that in the past among not-for-profits, and others, there has been "a culture of not telling people when they've lost people's data".

But the expert from the Our Community insurance partner says not-for-profits deal with "very private records because of the nature of their business", and that can't go unregulated.

His industry has been buzzing with suggestions that the Federal Government is ready to "throw the book at organisations that aren't sufficiently securing the information they're trusted with".

"I think they've got their eye on some organisations already," he says.

"Now it's crunch time and you don't want to be the one that is made example of."

Our tougher Australian laws are being mirrored in the US, Asia and Europe, with many not-for-profits doing business in those countries.

The Office of the Australian Information Commissioner (OAIC), said ahead of the new laws being enforced, it had worked with consumer groups, not-for-profits, and Australian Government agencies in the development of new resources aimed at clarifying the new rules.

The Australian Information Commissioner, Timothy Pilgrim, said, "the Notifiable Data Breaches scheme formalises a long-standing community expectation to be told when a data breach that is likely to cause serious harm occurs.

"The practical benefit of the scheme is that it gives individuals the chance to reduce their risk of harm, such as by re-securing compromised online accounts. The scheme also has a broader beneficial impact - it reinforces organisations' accountability for personal information protection and encourages a higher standard of personal information security across the public and private sectors," Mr Pilgrim said.

What's your plan of action?

Not-for-profits should already have a plan of action to be implemented if a breach or a cyber attack occurs.

Depending on the organisation, this could include having an insurer, legal advisers, public relations experts and information technology experts on hand to assist with a crisis.

Not-for-profits should develop an "incident response plan" and test it, Mr Brooks says.

"Let's say you get an email demanding $5000 or they'll release some private information. What are you going to do next?"

This includes your immediate "incident response" reaction in the first 24-48 hours, which may include determining what type of attack has occurred and how to protect remaining data.

The secondary part of your plan should assess how you're going to respond to any regulatory or legal claims, with the risk of class actions in Australia increasing.

"It's not difficult, and there's plenty of organisations - and Aon is one of them - where organisations can get help," Mr Brooks says.

More about the new data breach laws

The much anticipated Privacy Amendment (Notifiable Data Breaches) Bill 2016 come into force on February 22, 2018. The new law makes it mandatory to notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals if your organisation has a data breach. This is Aon's advice.

Who do the changes apply to?

The new law applies to public and private organisations that are already subject to the Privacy Act. This includes Australian government agencies (excluding state and local government) and all businesses and not-for-profit organisations with an annual turnover more than $3 million.

When will the new law come into effect?

The new law came into effect on February 22, 2018.

What happens if you don't comply?

If your organisation doesn't comply with the new laws, you could face penalties including fines of up to $360,000 for individuals and $1.8 million for organisations.

Aon says these financial implications will require a systematic change of attitude for many organisations, and conversations about cyber risks and data security need to be elevated to boardroom level.

How can your organisation prepare?

Aon recommends that organisations affected by the new law act immediately - appoint a steering committee to address the new law changes, run a full risk assessment, and consider your insurance coverage to ensure your organisation is prepared when the law comes into effect.