Cybercriminals have targeted Wattle Range Council on South Australia’s Limestone Coast, extracting approximately 43,000 files from an outdated server.
Wattle Range Mayor Des Noll reported that the stolen data primarily included rate notices and publicly accessible information.
“It was things like rate notices and very minor data – data that’s publicly accessible,” he said, as reported by ABC. “At this point, we haven’t detected anything that was confidential.”
The attackers have issued a ransom demand to the council.
“Legislatively, we’re not allowed to pay demands, and we’d never anticipate paying demands,” Noll said.
In response to the incident, the council is transitioning its systems to a more secure and updated platform to better protect its data.
Cybersecurity issues have affected several councils across Australia, including those in Adelaide.
Paul Haskell-Dowland, a cybersecurity expert from Edith Cowan University, pointed out that local governments are attractive targets due to the valuable information they hold and the critical services they provide.
“They have high-value information that can be resold, but they’re also offering critical services,” he said, as reported by ABC. “Plus, we shouldn’t underestimate the opportunity to pivot from local government systems into state government, or indeed federal [government systems].”
He noted that smaller regional councils often lack adequate IT resources, which could lead to unreported breaches. Although paying ransoms might seem tempting, the federal government strongly discourages it.
“I think it’s very unlikely that a local, state, or federal government entity would publicly be seen to be paying a ransom to a cybercriminal gang,” he said.
Haskell-Dowland’s comments align with the results of a cyber risk analytics platform’s report, warning about the rise of cyberattacks facing public sector entities. The report advised government agencies to improve their cybersecurity resilience, strengthen election integrity, and collaborate with cybersecurity professionals to address cyber risks effectively.
A representative from the Local Government Association (LGA) acknowledged that despite strong security measures, councils are still vulnerable to cyberattacks.
“Councils have robust protections and security measures in place to protect sensitive information and data; however, despite these safeguards, cyberattacks do occur,” a spokesperson for the LGA told ABC.
The LGA offers policies, guidelines, and strategies to assist councils in bolstering their cybersecurity defences.
Haskell-Dowland recommended fundamental cybersecurity practices, such as keeping systems updated and using complex passwords.
