Cyber Incident Victim: Knox City Council
Date:
Apr 2024
Location:
Australia
Summary
Knox City Council experienced a cybersecurity incident involving unauthorized access to third-party vendor OracleCMS's systems, which handle after-hours customer calls. While the council's own infrastructure remained uncompromised, the breach potentially exposed customer names, phone numbers, and partial property addresses from calls made outside business hours. OracleCMS is collaborating with cybersecurity experts and government authorities to secure their systems and investigate the incident. As a precaution, the council instructed OracleCMS to cease collecting customer information and route urgent requests directly to staff. Affected individuals will be notified if data exposure is confirmed.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Knox City Council became aware of a cybersecurity incident on April 1, 2024, involving OracleCMS, a third-party provider managing after-hours customer calls for the council. An unauthorized actor had accessed a segment of OracleCMS's data and subsequently published files online. OracleCMS engaged cybersecurity specialists and government authorities to secure its systems and investigate the breach. The compromise did not extend to Knox City Council's internal infrastructure, as their systems remained unaffected. Initial analysis indicated the exposed data potentially included customer names, phone numbers, and partial property addresses limited to individuals who contacted the council outside standard business hours through OracleCMS channels.
Knox City Council implemented precautionary measures by directing OracleCMS to cease collecting customer information and reroute urgent requests directly to council staff until further notice. The council acknowledged the possibility of customer data exposure but emphasized confirmation was pending the ongoing investigation. They committed to directly notifying affected individuals with guidance if data access was verified. Operational continuity measures were enacted to maintain essential services during the disruption. Public communications advised vigilance against potential scams exploiting leaked contact details, though no specific evidence of misuse was confirmed. Updates were promised as the investigation progressed, with OracleCMS leading remediation efforts under oversight from cybersecurity professionals and government agencies. The council reiterated its focus on customer data security while maintaining standard operations through adjusted service protocols.