Citizen Data Under Threat From Targeted Cyberattacks on Governments Agencies

Attacks on Australian government organizations

• In May 2020, cybercriminals illegally accessed the email accounts of 47 staff members of the New South Wales (NSW) Department of Customer Service, which functions as a service provider to support the government in New South Wales, Australia.
• In April 2020, the Australian Digital Health Agency (ADHA) stated that on two occasions, the federal government's myGov portal ‘My Health Record’ was likely used to conduct Medicare fraud. The affected consumers could have had their demographics, including name, address, date of birth, and Medicare information exposed.
• In January 2020, the West Australian government-owned Perth Mint suffered a data breach that compromised the details of more than 1000 visitors which included visitor names, email addresses, home addresses, and telephone numbers.

Government-assistance lures delivering extraordinary benefits to threat actors

• In April 2020, an upward surge was noticed in social-engineering lures by Zeus Sphinx in malicious emails that promised victims financial relief during the coronavirus pandemic. This spread as the news of governments mulling financial relief packages, in response to the economic stall brought on by the COVID-19 epidemic.
• In March 2020, Zeus Sphinx was distributed using malicious document files via spam and used the Covid-19 pandemic to spread phishing, scams, and malware. These malspam campaigns featured booby-trapped document files named “COVID 19 relief” and subject lines relying on the same theme.

Safety first