Cyber Incident Victim: Court Services Victoria
Date:
Nov 2023
Location:
Australia
Summary
Court Services Victoria experienced a cyberattack compromising its audiovisual network, resulting in unauthorized access to court hearing recordings over a seven-week period, including some prior proceedings. The breach potentially exposed video and audio content from supreme, county, magistrates, coroner’s, and children’s courts, though no other systems or sensitive data were affected. The organization isolated the impacted network, enabling hearings to proceed while implementing broader security enhancements during restoration.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
A cyber attack compromised the audiovisual (AV) network of Court Services Victoria (CSV), the administrative body for courts in the Australian state of Victoria. The breach was first detected by CSV on 21 December 2023, but forensic analysis indicated the initial network intrusion occurred on 1 November 2023. Attackers gained unauthorized access to a database containing video and audio recordings of court hearings over a seven-week period ending in December. According to CSV Chief Executive Louise Anderson, recordings from the supreme, county, magistrates, and coroner’s courts were confirmed as accessed during this timeframe, with data potentially exfiltrated. One recording from the children’s court dated October 2023—prior to the confirmed intrusion window—was also identified as compromised, suggesting possible earlier vulnerabilities.
The breach exclusively affected hearing recordings stored on the AV network infrastructure, with CSV confirming no penetration of other court systems containing employee records, financial data, or non-AV judicial documents. Upon discovery, CSV immediately isolated and disabled the compromised network segment to prevent further access. Scheduled court hearings proceeded without cancellation following containment measures. Restoration efforts included plans to enhance security protocols across the broader court and tribunal technology ecosystem. CSV declined to disclose whether the incident involved ransomware demands or the identity of threat actors. The organization did not specify the total number of recordings accessed, the method of initial compromise, or whether affected parties received individual notifications.