Hack attack sparked months of delays for firefighters

A cyberattack that hobbled the fire service’s dispatch system hampered crews rushing to burning buildings and forced them to use a manual back-up scheme for eight months.

“The use of pagers, mobile phones and radios increased the time it took firefighters to turn out from the station,” a briefing document prepared for Emergency Services Minister Jaclyn Symes – obtained by the state opposition and seen by The Age – revealed.

Fire Rescue Victoria suffered a cyberattack in December 2022.Credit: Akalanka Sameera

Fire Rescue Victoria suffered an outage in the December 2022 attack and did not get its dispatch system running again until August 2023, the briefing document and quarterly progress reports show.

Victorian government IT projects routinely face cost blowouts and delays. The Age this week revealed that a fresh wave of IT cost overruns is expected to top $100 million across state government departments and agencies.

While FRV and the Fire Services Implementation Monitor say the months-long IT outage did not harm community safety, average response times did take a hit.

In the three months after the cyberattack, FRV was more than 10 percentage points off its target of reaching 90 per cent of structure fires within 7.7 minutes, according to quarterly performance reports by the monitor, which independently assesses and reviews state government fire services reforms.

The following quarter – covering April, May and June last year – it was still 6.87 percentage points worse than the same period a year earlier.

While the outage did increase the time it took for crews to get out of a station, once they left, the time it took to get to the scene was unchanged, FRV said.

The briefing document, prepared by the Department of Justice and Community Safety in September, was released to the opposition under freedom-of-information laws and provided to The Age.

“Public information provided by FRV following the cyberattack stated ‘community safety has not been compromised’, which may be viewed as at odds with the decline in response time performance,” the brief said.

Asked why it took so long for the dispatch system to be restored, FRV said it required extensive testing at fire stations around the state to ensure its ongoing security.

In its 2022-23 annual report, FRV said it was spending more than $20 million outsourcing its response to the cyberattack to consultants.

But Peter Marshall, secretary of the United Firefighters Union – which is in a protracted pay dispute with the FRV – said the service had dragged its heels on resolving the issue.

He said crews had been forced to use pen and paper – something the fire service disputes.

“We are totally disillusioned and frustrated by the inadequacy and inaction of FRV over rectifying the issues arising out of the cyberattack,” Marshall said on Thursday.

The dispatch system was revived last August, but 15 months after the cyberattack it still does not have full functionality. The latest quarterly report, published in March, said it was still not possible to track its performance across some measures.

It was not until the quarter ending December that FRV returned to the pre-cyberattack average, which was still below target.

In October, the union separately lodged a dispute with the Fair Work Commission over delays restoring Firecom – a communications system used during emergency responses that also provides a live map tracking every FRV appliance in the state – claiming the delays put members in an unsafe environment.

The union said they resulted in “extreme difficulty” overseeing and prioritising crews during two fires in October last year. It said it took 14 minutes for firefighters to reach a Thornbury house fire shortly after significant resources had been put towards a mattress factory fire in Preston.

An FRV spokesman said the service acted quickly after the cyberattack to immediately put in place contingencies to get fire crews to emergencies.

“These arrangements worked well thanks to the professionalism, dedication and resilience of our people, who are committed to serving the community,” the spokesman said.

“FRV took decisive action in response to the attack, and we have worked cautiously to restore, recover and rebuild our systems.

“FRV sets a high standard with its benchmarks for response times and there was no evidence of loss of life or property caused by the impact of the cyberattack.”

Shadow emergency services spokesman Richard Riordan disputed the claim that community safety was not put at risk as a result of the cyberattack, given response times worsened.

“The Allan Labor government must explain why the community was misled about the impact and duration of this cyberattack,” Riordan said.

“Victorians were told community safety would not be compromised following this attack, yet with response times having fallen as a consequence, this claim is simply wrong.”

Credit: Paul Rovere

A government spokeswoman reiterated that there was no risk to public safety.

“During the cyber incident, FRV reverted to back-up systems and continued to urgently deploy crews to incidents – there was no risk to public safety,” the spokeswoman said.

“Neither the Fire Services Implementation Monitor nor FRV have identified any negative impact on community safety because of the incident.

“We set very high standards and targets to ensure firefighters continue to deliver the best service to the community and that Victorians are well protected, no matter where they live. We will work with our fire services to ensure continued high quality service delivery that keeps our communities safe.”

The private information of staff was also exposed in the cyberattack and shared on the dark web.

Start the day with a summary of the day’s most important and interesting stories, analysis and insights. Sign up for our Morning Edition newsletter.