Russian hackers have released over 16,000 confidential documents on the internet, including personal details sourced from 192 schools statewide, Science and Technology Minister, Madeleine Ogilvie said on Friday.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
The schools on the list, including Launceston-area state schools such as Launceston College, West Launceston Primary School, and Mowbray Heights Primary, are part of a large-scale breach by a Russian hacking group that accessed a third-party file transfer service being utilised by the state government.
"We knew that this is a very real risk, which is why we had our emergency management arrangements on standby over the Easter break, and we have now activated those," Ms Ogilvie said.
"We fully understand how concerning this is for all Tasmanians ... and I should reiterate that we have seen 16,000 documents released and it may well be that we will see more."
She said the government was working through the data set that has been released. It is prioritising contacting school principals to inform them of the data breach.
"My understanding is that the information that has been released relates to those financial data sets pertaining to education department students, families ... this is important information," she said.
She said that no ransom has yet been received from the hacking group, and that it was the Australian government's advice not to pay ransoms anyway.
She said the data released contained names and addresses, and often included financial details, including of parties acting as suppliers to these schools.
Deputy secretary of government services at the Department of Premier and Cabinet, Rob Williams said it was usual practice for the government to encrypt this data when transferring over third-party services such as the one breached, GoAnywhere MFT.
Mr Williams did not answer questions about whether hackers accessing information via GoAnywhere had also breached that government encryption.
Ms Ogilvie confirmed that the government was still using the GoAnywhere MFT, saying that a patch applied in January had closed the breach exploited by the Russian group.
She said the stolen data had been accessed before that patch was applied.
Mr Williams said the government was still using the service because it was world "best practice" in terms of secure large-scale data transfer between servers.
Ms Ogilvie said that the state government has engaged the services of ID Care Australia - a charity formed to help individuals confronting identity and cyber security concerns.
"We have a Tasmanian information service available to support Tasmanians who are concerned about the breach," she said.
She asked Tasmanians to "stay vigilant" for scams that may be making use of the new information available.
The news of the large-scale data leak came after a week in which the government played down the risk, despite the hacker group confirming the government as 1 of 130 organisations that it had exploited via GoAnywhere MFT.
The files online so far include an invoice marked with the name of the Burnie school, as well as applications by individual students for the Student Assistance Scheme program.
Labor's technology spokeswoman Jen Butler called for Premier Jeremy Rockliff to step in to provide leadership on the issue and said Ms Ogilvie should resign.
"Why on earth was this Minister allowing the use of unsafe software?" she said.
"This software was reported to be unsafe from late January, yet the Tasmanian government have released Department of Education and Children using that software.
"We know that nearly every primary school across Tasmania has been listed as compromised.
"But we also know that many other business organisations around Tasmania are being contacted to say that they may have been compromised and these may be suppliers to the Department of Education or financial groups that may have dealings with the Department of Education.
"One of the businesses that I spoke to, a service provider of equipment, said they may have been compromised because of their transactions with the Department of Education and Children.
"We could say that every person and every entity that has a connection to the Department of Education could be compromised."
"This isn't about politics, this is about keeping Tasmanians safe."
Opposition leader Rebecca White said on Friday that she had written to the Premier requesting a briefing on the matter, after a similar request of Minister Ogilvie was rejected earlier this week.
"It is inexcusable how she has handled this crisis over the past fortnight," she said.
"Students and their parents are rightly concerned and it is vital the Premier starts to show the leadership that such a serious situation demands.
"Jeremy Rockliff needs to tell Tasmanians what exactly has occurred, what his government is going to do to manage this extremely concerning data breach, what support is available to families who fear they have been affected, and how that support can be accessed."
News that the third-party software, GoAnywhere MFT, had been breached by the Russian hacking group Cl0p, first emerged in late January.
Australian companies confirmed to have lost data in the breach include Crown Resorts and mining giant Rio Tinto.
Our journalists work hard to provide local, up-to-date news to the community. This is how you can continue to access our trusted content:
- Bookmark www.examiner.com.au
- Make sure you are signed up for our breaking and regular headlines newsletters
- Follow us on Twitter: @examineronline
- Follow us on Instagram: @examineronline
- Follow us on Google News: The Examiner