Australia is seen as an easy target for cyberattacks, says an expert.

“And it has been for the past few years,” Jake Moore – global cybersecurity advisor for software company ESET – told Government News.

Australia’s reputational rot set in following the 2022 Medibank breach, which compromised the privacy of 9.7 million Australians.

Describing the breach as “a huge wakeup call across the globe”, Moore told GN the attack saw data spilling all over the dark web – “10 million lines of data, very personal data”. Australia was subsequently viewed as vulnerable “and it opened up a floodgate of attacks”.

Moore is concerned that the establishment of a new government digital ID system – Trust exchange, or TEx – will “fuel more attacks”.

Working alongside existing government platforms – MyGov and MyGovID – TEx will allow Australians to use their mobile phones to verify their identity instead of sharing sensitive hardcopy documents with businesses and organisations.

Verifying individuals using credentials only held by the government – an address, date of birth, driver’s licence, citizenship status etc – TEx could be used when applying for rental accommodation or jobs, entering venues or checking into hotels.

Dubbed the “gold standard” of ID verification platforms by Government Services Minister Bill Shorten, TEx, say experts, is a potential honeypot of data just waiting to be hacked. Or, as Moore told GN, “a goldmine of information” which could, he said, “attract potentially even more cyberattackers”.

If you have any sort of exploit in that system you lose the trust

Moore’s fingers are crossed the system’s developers know what they are doing. But, he said, “bad actors already know where the vulnerabilities lie, and they’re predicting where the next ones are going to be”.

And, said Moore, the problem with governments is that they are notoriously slow to put protections in place. “If you’re going to produce something so open you’re going to have to make it extremely secure from the outset and you’re going to have to keep at bay a barrage of attacks which are naturally going to occur.”

When implementing such a system, staff training is key, Moore said. “Training seems to be something that is forgotten about by all sizes of businesses – government, organisations, public sector. It is so vitally important, and that’s for everyone across the board.”

Compartmentalising a data system is also critical. “Segmenting the network would potentially have stopped the big Medibank attack,” said Moore.

As he notes: the vast majority of cyberattacks arise from internal credential theft. “We’ve learnt this from organisations and countries from around the world for years,” said Moore. “This huge percentage – around the 80% mark – start with the human theft of those credentials.”

And so it was with the Medibank breach. Credentials were sold and purchased on the dark web then used to gain access to Medibank’s internal system. A similar strategy was played to penetrate Optus.

People’s faith and trust in platforms such as TEx is crucial if they are to be successful, Moore said. “If you have any sort of exploit in that system then you lose the trust you’re initially starting to gain – especially when it’s a public sector platform that includes public data.”