Understanding the Modus Operandi of Major Cyber Attacks in Australia (2020-2025)
- Yash Thakur
- Aug 7
- 4 min read
Australia experienced a sharp rise in high-impact cyber-attacks over the last half-decade, ranging from crippling ransomware in logistics and essential services to unprecedented mass data breaches at major telecommunication and health-insurance providers. The research table below, catalogues the most consequential events between 2020 and mid-2025, followed by an expansive analysis of attack patterns, root causes, and strategic lessons for organisations operating in the Australian threat landscape.
Toll Group Ransomware Wave 2020
Incident Summary
Toll Group, a critical logistics provider, endured two separate ransomware strikes within five months. The first incident in late January 2020 employed the Mailto strain, encrypting more than 1,000 servers and halting parcel tracking. Recovery took six weeks. In May, the newer Nephilim gang infiltrated Remote Desktop Protocol (RDP) endpoints, exfiltrated around 220 GB, and threatened leak-ware publication
Key Technical Factors
Persistently exposed RDP services with weak password hygiene.
Insufficient network segmentation allowed lateral traversal.
Data exfiltration went undetected due to limited outbound traffic monitoring.
Strategic Lessons
RDP must be either decommissioned or protected behind MFA-enabled gateways.
A mature egress-filtering strategy is as vital as perimeter ingress rules.
Repeat victimisation underscores the need for continuous purple-team exercises to
validate post-incident hardening.
Service NSW Email Account Compromise 2020
Incident Summary
Cyber criminals phished 47 Service NSW employees, gaining mailbox access that contained 3.8 M documents (730 GB). Manual analysis identified about 104,000 customers whose identity document licenses, passports and birth certificates were exposed.
Key Technical Factors
Spear-phishing emails delivered malicious links.
Credentials harvested via fake Office 365 login.
Attackers used OWA/IMAP to exfiltrate mail archives, bypassing basic anomaly thresholds.
Strategic Lessons
Email remains the blunt instrument of choice. Zero-trust mail-gateway isolation plus enforced security-key MFA would have thwarted credential theft.
Organisations holding large identity datasets must implement "data minimisation" to reduce breach blast radius.
BlueScope Steel Ransomware 2020
Incident Summary
On 15 May 2020, BlueScope detected ransomware in one of its U.S. subsidiaries; the infection propagated to Australian manufacturing operations, forcing plant shutdowns and manual steel dispatch.
Key Technical Factors
Likely exploitation of unpatched CVE in Citrix/remote gateway or weak RDP.
Thin segmentation between operational-technology (OT) and IT networks amplified impact.
Strategic Lessons
Industrial operators must adopt IEC 62443 segment-by-design principles.
OT runbooks should rehearse manual fail-over to avert revenue-crippling downtime.
Parliament House & Channel Nine Incidents 2021
Incident Summary
Late March 2021 saw two synchronous cyber events: parliamentary email outages and a
sabotage style breach at Channel Nine that blocked production of the flagship "Weekend
Today" show. Although attribution remains contested, officials cited "state-based tradecraft
Smartphones and tablets at Parliament malfunctioned, hinting at mobile device management
compromise
Strategic Lessons
Supply-chain and media outlets are high-value influence targets; redundancy in broadcast OT and resilient MDM policies are essential.
Crisis-communications drills must consider simultaneous attacks on government and media, complicating public messaging.
Optus Mass Data Breach 2022
Incident Summary
"Optus" dormant unauthenticated API was exposed to the internet in 2020 but retained a logic flaw from 2018 that disabled access checks. An attacker iteratively scraped the endpoint, acquiring PII for 9.8 M current and former customers—one-third of the Australian population.
Technical Breakdown
Older code branch bypassed token validation when specific headers were absent.
No rate-limiting or behavioural analytics flagged the high-volume enumeration
Policy Aftermath
Federal reforms fast-tracked info-sharing between banks and telcos.
Optus absorbed costs for document replacement and faces potential multi-billion-dollar
class actions.
Medibank Extortion Breach 2022
Incident Summary
Threat actors obtained VPN credentials from a third-party IT contractor lacking MFA, installed malware, and exfiltrated≈520 GB of highly sensitive health data between August–October 2022. When Medibank refused a US$10 M ransom, hackers progressively leaked files labelled “naughty” (drug & alcohol-related treatments) to shame victims
Technical Breakdown
Multi-factor authentication was not enforced on all privileged VPN accounts.
SIEM alerts between 25 Aug – 13 Oct were not properly triaged, delaying detection.
Strategic Lessons
Third-party access demands least-privilege & mandatory hardware-token MFA.
Health data attracts double-extortion; zero-retention policies for legacy PII mitigate damages.
Fire Rescue Victoria Ransomware (2022-2023)
Incident Summary
The Vice Society gang struck on 15 Dec 2022, paralysing FRVʼs dispatch IT. Manual radio and
pager procedures ensured 000 responses but increased crew workload. On 10 Jan 2023, Vice Society leaked HR files, budget sheets, and applicant data on their Tor site,
Technical Observations
Attack exploited underfunded local-gov cybersecurity budgets.
Ransomware gangs pivoting from education to essential services escalate public-safety stakes.
Latitude Financial Data Breach 2023
Incident Summary
Latitude's supplier environment was phished; stolen SSO credentials granted network entry and allowed bulk pulls of historic loan-application data. 7.9 M driver-licence numbers and transactional statements were stolen. Recovery costs hit A$76 M by August 2023, erasing half year profits.
Strategic Lessons
Even regulated financial entities suffer when supply-chain identity is weak.
Large historical datasets for credit assessment should be tokenised or archived offline.
Cyber-Attack Trend Patterns exhibited:
1. Authentication Weaknesses Dominate
Across incidents, stolen or absent credentials (Medibank, Latitude) and unauthenticated APIs
(Optus) were decisive. Mandatory hardware-based MFA and continuous identity assurance
would have prevented or limited most breaches.
2. Data Minimisation as Damage Control
Optus and Medibank held years-old dormant customer records, greatly expanding breach scope. The Privacy Act's “destroy or de-identify” clause must shift from compliance footnote to operational imperative.
3. Double-Extortion Ransomware
Toll, BlueScope, FRV and Medibank reveal a shift from pure encryption to data-leak coercion,
forcing boards to improve exfiltration detection and incident-response communications.
4. Supply-Chain Exposure
Latitude and Medibank demonstrate that third-party vendors remain the weakest link. Comprehensive third-party cyber-risk management frameworks (critical-supplier SOC 2 reviews, privileged-access sandboxing) are increasingly non-negotiable
5. Critical Infrastructure Targeting
Fire and ambulance services, steel mills and telecoms illustrate adversarial interest in high impact public services, aligning with global trends of disrupting societal functions for leverage.
Organisational Playbook Imperatives: -
1. Zero-Trust Baseline
Enforce least-privilege, network micro-segmentation, and continuous authentication.
2. API Security Lifecycle
Inventory, authenticate, and rate-limit every endpoint; adopt spec-first design with
rigorous security testing.
3. Data Retention & Tokenisation
Apply strict purging schedules and tokenise historic PII to mitigate breach impact.
4. Purple-Team Drills
Simulate ransomware and API-abuse scenarios; validate incident-response plans
quarterly.
5. Supply-Chain Governance
Embed contractual obligations for MFA, logging, and breach notification within vendor
agreements.
Conclusion
Between 2020 and 2025, Australia transitioned from sporadic ransomware hits to nation spanning data catastrophes that galvanised legislative change and re-defined corporate cyber risk appetites. The attacks chronicled here expose recurring gaps—unguarded APIs, inadequate MFA, and over-retained personal data—that adversaries continue to exploit. Organisations must embrace a zero-trust, data-minimalist mindset, backed by board-level accountability and rigorous third-party oversight, to avert a repeat of the last half decade's costly lessons.
Comments