.png)
CISOs are on notice after the Federal Court handed down a landmark $5.8M civil penalty - the first of its kind under the Privacy Act (1998). The Australian Information Commissioner initiated proceedings against Australian Clinical Labs for serious privacy failures and a lacklustre response to a data breach that struck just one month after acquiring MedLab. This case sets a startling new benchmark for regulatory enforcement and fundamentally reshapes how CISOs and CIOs must approach mergers, acquisitions, and technology integrations. The unmistakable message: organisations can no longer afford even short-term cybersecurity capability gaps.
I’ve summarised the three court findings, key failures and offer some recommendations for organisations to actively consider.
The court found three key contraventions:
- $4.2M finding that ACL did not have adequate cybersecurity controls across the acquisition’s IT environment, so they “did not take reasonable steps to protect the personal information of those individuals that ACL held on certain Medlab servers from unauthorised access, modification or disclosure”
- $800k finding that ACL failed to perform a reasonable and expeditious assessment of whether there were reasonable grounds to believe there was an eligible data breach.
- $800k finding that ACL failed to prepare and give the OAIC a statement concerning the cyberattack as soon a practicable
There were stringent criticisms of ACL’s approach to the acquisition and integration of MedLab IT systems that have broad implications to the industry:
- ACL did not identify the IT security vulnerabilities in MedLab systems prior to acquisition. While there was a 6-month plan for integration, the court found there were a number of key deficiencies including lack of Endpoint Detection & Response, weak authentication/MFA on high-risk services such as the VPN, insufficient log history on key security appliances and running EOL Microsoft servers.
- ACL did not take ‘such steps as are reasonable in the circumstances’ to protect the personal information that MedLab systems held. The court explicitly highlighted the circumstances to be the size and nature of the ACL business, the volume and sensitivity of the information, the high industry cybersecurity risks facing ACL and the risk of serious harm to individuals if their personal information was breached.
- There was inadequate testing of incident management processes as soon as MedLab was acquired. The ACL incident handler put in charge of the response had received no training on cybersecurity incident response, including malware and ransomware playbooks. Furthermore, it was found that those playbooks had multiple deficiencies in terms of role assignment, limited detail on containment processes and/or steps to mitigate data exfiltration.
- The digital forensics investigation by the third-party provider was found to be inadequate due to their limited monitoring of the new environment, lack of research into the ‘Quantum Group’ ransomware group traits to determine if data exfiltration was likely and limited investigation of whether persistent mechanisms had been deployed by the group to stay connected to the environment. As ACL knew the investigation was limited it was found to be unreasonable to rely on that advice and conclude there had been no data breach.
These findings clearly challenge historical approaches to integration of new acquisitions and eliminates the preconception of a reasonable window of time to uplift operations falling short of cybersecurity benchmarks. While ACL cooperated with the OAIC, admitted liability and have committed to continuing to strengthen their data security, the $5.8M fine and public rebuke is impactful to any sized organisation and warrants fresh eyes on cyber security programs. To act on the clearly stated expectations of the Federal Court we recommend that organisations:
- Perform an Essential Eight Cyber Maturity Assessment on your business and any acquisition targets to ensure you’ve covered the fundamental security technologies. We can perform this quickly with minimal stakeholder burden and board ready presentation outputs. Any gaps can be swiftly addressed with Cythera’s industry leading managed security suite of services.
- Update cyber security incident and data breach response plans, likely with wholesale replacement of old artefacts with current best practices, and test them regularly with tabletop simulations at both the technical and executive levels.
- Establish a digital forensics incident response (DFIR) retainer with Cythera’s expert team to enable lightning fast and appropriately comprehensive investigation of incidents to determine if a breach has occurred.
It is reassuring that the privacy of Australians is being protected in the courts. It’s now on Australian business leaders to investigate and uplift their cybersecurity practices. Contact us at Cythera for a pragmatic discussion on how to keep ahead of the curve.
