80,000 SA public service staff bar school workers hit in Frontier Software payroll hack, Lucas confirms

If you’re one of the tens of thousands of SA public servants who don’t work in education, assume your name, address, tax and bank details are now in the hands of hackers.

Almost all South Australian public service workers should assume hackers have stolen their personal information, the treasurer says, as the state government confirmed almost 80,000 staff were victims of a major cyber attack.

The government on Friday announced that the records of at least 38,000 public sector employees had been accessed during a large-scale security breach on external payroll software provider Frontier Software.

It said a further 42,000 staff may also have been affected.

The names, home addresses, tax file numbers and bank account details of government employees, from Premier Steven Marshall down, were stolen.

South Australian Treasurer Rob Lucas has apologised to government workers over a cyber-attack that saw hackers raid details of everyone from the Premier down. Picture: David Mariuz

Only education department employees appear to have been spared.

The Advertiser revealed on Friday evening that an offshore hacker demanded a ransom payment to return the payroll information.

Sources said the culprits were Russian hackers who likely breached security about a month ago.

It is understood the contract between the government and Frontier states the company should not have the government’s data and it should remain on the government’s own server. It is understood this is being investigated.

Treasurer Rob Lucas on Tuesday said following an analysis of the attack, he could now confirm that nearly 80,000 public sector employees had been exposed.

“I am advised all public sector employees, except for Department of Education staff who are on a different payroll system, should assume that their personal information has been accessed during Frontier Software’s cyber-attack,” he said.

Mr Lucas apologised on behalf of the government to affected workers and said they would “continue to be kept informed as our investigation with Frontier Software continues”.

Frontier Software Australia chief executive officer Nick Southcombe said digital forensics work into the attack was continuing however the initial cause of the incident “has not yet been fully determined”.

“In the meantime, we have implemented heightened cyber security measures across all our systems, including additional 24/7 monitoring for any further malicious activity; of which to date there has been none,” he said.

Mr Southcombe said the company was “committed to learning from this experience and implementing all necessary cyber security measures to minimise the likelihood of an incident occurring in future”.

The attack is now under investigation by the Australian Federal Police.

Since being advised of the data breach, the government has undertaken several steps to minimise potential exposure such as working with the Australian Taxation Office to add extra security measures to all affected tax file numbers; asking banks and financial institutions to add additional safeguards to employees’ payroll bank accounts; and working with Services Australia to implement further security measures for staff.

Mr Marshall on Saturday would not answer questions from the media about whether the government would continue to use Frontier to manage payroll data.

SA Best MLC Frank Pangallo said the government must sack Frontier Software and find a more secure provider.

“Public sector employees are now extremely worried and their trust has been severely breached,” he said.

“With all that information, it’s going to be very easy for identity fraud.”