Global ransomware group claims Fire Rescue Victoria cyber-attack as staff data hits dark web

Cybercriminals are now targeting Fire Rescue Victoria employees in the wake of last month’s data heist, releasing their stolen personal information on the dark web.

A global cybercriminal group is targeting employees of Fire Rescue Victoria in the wake of last month’s data heist, releasing stolen personal information on the dark web.

Former, current and prospective staffers were notified about the safety risk via a confidential email sent from FRV bosses on Tuesday.

“... We have reasonable grounds to believe that personal information of current and former employees, individual contractors and secondees of FRV and the former Metropolitan Fire and Emergency Services Board (as well as job applicants and other individuals) may have been accessed or stolen by the criminals,” an FRV spokesman said.

“We have now received confirmation that the criminals have released FRV information on the ‘dark web’. This is a very unfortunate situation, and I understand you may be concerned.”

Shed fire at Govett Cres St Albans Park with Police, CFA Fire Rescue Victoria and ambulance in attendance Picture: Mark Wilson

According to Cyber Security Connect, Global ransomware group Vice Society – known for previous attacks in the Northern Hemisphere – has claimed responsibility for the heist and released relevant data to back its claims.

The government agency came under attack by the group on December 15, resulting in a mass IT outage which took down communication systems used by firefighters.

Instead of automatically receiving calls from ESTA on a computer monitor, crews were forced to revert to radios and mobile phones to retrieve crucial job information.

It is understood FRV’s 85 fire stations were this week still using offline resources to manage day-to-day operations despite initial believing systems would only be down for about a week.

One senior IT source told the Herald Sun last month’s attack was “one of the worst” ever seen on a government agency in Australia.

An email from FRV bosses discussing the release of employee information on the dark web. Picture: Jacqui Epstein

The office of the Australian Information Commissioner was notified of the concerning development on January 6, the statement read.

Those impacted have been offered free support from IDCARE, Australia’s national identity protection and cyber security support service, and Equifax to set up individual credit and identity protection monitoring.

“It is a complex task to analyse the data that has been shared on the dark web, and we have cyber security specialists assisting with this analysis.”

“FRV will attempt to contact anyone who might be affected by the incident to alert them to these tips and the support available,” the spokesman said.

“We encourage those who may be affected to remain vigilant with all online communications, validate any information they receive and follow other cyber security tips.”

Response times to emergency situations have not been impacted.