NSW Treasury

Summary

NSW Treasury experienced an alleged data breach in which over 5600 sensitive documents authored by multiple departments were accessed. An employee of the agency's commercial team was arrested and charged in connection with the incident. A government taskforce later declared the breach contained and said that investigations found no adverse impact on any government projects or procurements.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The alleged data breach at NSW Treasury was reported by the state government late last month. The government disclosed that over 5600 sensitive documents authored by multiple departments had been accessed without authorization. An employee of Treasury’s commercial team was arrested and charged in relation to the alleged exfiltration of those documents. The arrest marked the first legal action taken in connection with the incident.

Following the disclosure, the government established a taskforce to investigate the breach and evaluate its potential impacts. The NSW chief cyber security officer later issued a statement on behalf of the taskforce. In the statement the officer said that the incident had been declared contained. The officer also added that efforts to date to determine any potential impacts on active or past government procurements showed that no project had been adversely affected.

Based on those findings, the government downgraded the assessed impact of the alleged breach. The downgrade reflected the conclusion that no project had suffered harm from the unauthorized access. The incident narrative therefore consists of the reported access, the employee arrest, the containment declaration, and the determination of no project impact.

Sources

Sources available to members: 1 source.