Australia Overhauls Cyber Defences With A$587 Million Plan After Major Breaches

On Wednesday in Sydney, Cyber Security and Home Affairs Minister Clare O'Neil stood before reporters and said the country could not go on as it had. Her government was unveiling a seven-year, A$587 million ($382 million) cyber security strategy, its answer to a run of attacks that left millions of Australians exposed and, earlier this month, brought supply chains to a standstill.

The measures are wide-ranging. Small businesses will get cyber health checks. Funding for cyber law enforcement will rise. Ransomware attacks will become subject to mandatory reporting. Telecommunications companies will face the tougher cyber reporting rules that already apply to critical infrastructure. The government also plans to seek migrants to build up the cyber security workforce, and to set limits on how government agencies share data with one another, a step meant to encourage people to report incidents.

The plan follows a hard year for the Labor government. Nearly half of the country's 26 million people had personal information stolen in just two corporate data breaches. Those were the 2022 breaches at Optus, the No. 2 telco owned by Singapore Telecommunications, and at Medibank Private, the No. 1 health insurer. The stolen data was sometimes years old, and some of it belonged to people who were not even customers. This month, a cyber attack on the country's biggest port operator halted supply chains.

O'Neil described the pressures in plain terms. She said Australia could not have data flying around the country or critical infrastructure starting to fail, and she noted that small businesses and citizens keep telling the government they feel vulnerable and unable to cope with cyber threats on their own. Prime Minister Anthony Albanese said national security has typically meant military assets in the traditional sense, but is increasingly about cyber because of its economic impact.

The numbers back up the concern. The Australian Cyber Security Centre reported this month that cybercrime reports jumped by nearly a quarter in the year to June, while the average cost to victims rose 14%. The centre also noted that a new defence agreement with the United States and Britain had made Australia a bigger target. Separately, the Australian Securities and Investments Commission said this month that 44% of the companies it surveyed had no plan to stop data breaches originating from supply chain partners.

O'Neil singled out small and medium-size businesses. Large companies, she said, receive some of the biggest attacks but typically recover, whereas an attack on a smaller firm can be terminal. Australia has an estimated 2.5 million such businesses. Patrick Wright, head of technology and enterprise operations at National Australia Bank, the No. 3 lender, called the sector a huge driver of economic growth that continues to face alarming rates of cyber crime. Aidan Tudehope, co-founder of Macquarie Technology, which supplies data services to 42% of Australian federal agencies, called the strategy a unifying nationwide endeavour after policy had become fragmented.

Other elements include a single portal for reporting cyber attacks and "cyber rapid assistance" teams to respond to incidents in the Pacific region, along with work to identify network vulnerabilities. The government also intends to reduce the amount of customer data companies are required to keep, a direct response to how the Optus and Medibank breaches exposed information held for years.

What to watch is delivery. The portal, the data retention limits and the rapid assistance teams all have to materialise within a seven-year timeline, and the ransomware reporting rules will show how far the government is willing to compel companies to disclose.