A spokesman for acting Minister for Cyber Security Andrew Giles declined to comment on Wednesday, referring to remarks by Hamish Hansford, a Department of Home Affairs official, who is acting as the national cybersecurity co-ordinator.
Mr Hansford said on Tuesday that he had no details on how the hackers got into St Vincent’s systems or what information they removed, but said the government was working with the organisation to find out.
“If you think about your own email system, you’ve got thousands of emails coming in. And if a small percentage of those has been compromised, it would take some time for you to go through and work out what’s missing,” Mr Hansford said on ABC radio.
Voluntary measures
The government unveiled a new cybersecurity strategy in November, under which it would require business to report hacks, invest an extra $587 million over six years, and create a team to learn from hacks.
But more ambitious ideas that the government had floated, such as putting responsibility on large software vendors for the safety of their products, were instead introduced as voluntary measures.
In the DP World and Latitude hacks, overseas hacking groups gained access via holes in third-party software used by the ultimate targets.
A spokeswoman for St Vincent’s, which has engaged the cybersecurity response company CyberCX, said its work was continuing and that it would contact people directly if their data had been stolen.
“The investigation and monitoring efforts are continuing around the clock this week,” the spokeswoman said in a statement.
The Saturday Paper reported that St Vincent’s Hospital in Sydney’s inner east, a public hospital run by the wider St Vincent’s Health Australia group, was in financial turmoil and asking the state government for more funding.
