The private health and financial sectors suffered more data breaches than any other sector between April and June, with human error a major source of those breaches.
The quarterly notifiable data breaches report published by the Office of the Australia Information Commissioner (Oaic) on Tuesday found malicious or criminal attacks accounted for 59% of data breaches, with theft of paperwork or storage devices a significant source of those attacks. Human error accounted for 36% of data breaches.
“Further, many cyber incidents in this quarter appear to have exploited vulnerabilities involving a human factor (such as clicking on a phishing email or disclosing passwords),” the report found.
The private health sector was the most vulnerable with 49 breaches in total, 29 of which came from human error, while 20 breaches were the result of a malicious or criminal attack. This was followed by the finance sector with 36 breaches; the legal, accounting and management services sector with 20 breaches; the private education sector with 19 breaches; and the business and professional associations sector with 15 breaches.
“Most data breaches in the period involved the personal information of 100 individuals or fewer (61% of data breaches),” the report found. “Data breaches impacting between one and 10 individuals comprised 38% of the notifications.”
Under changes to the Privacy Act in February, entities have a duty to report data breaches to Oaic when a breach of personal information is likely to result in serious harm to individuals involved. The duty applies to any company or organisation with an annual turnover of more than $3 million that handles personal information. The report marks the first time data for a full quarter has been reported. Since the scheme began, Oaic has received 305 breach notifications.
Notifications made under the Act relating to My Health Record were not included in the report, as those data breaches are subject to different notification requirements. A separate Oaic report published last year found found in the 12 months to July 2017, My Health Record system operators reported six data breaches while the chief executive of Medicare reported a further 29 My Health Record breaches.
The Oaic’s acting privacy commissioner, Angelene Falk, said the notification scheme ensured individuals were notified when the security of their personal data was compromised.
“Notification to the Oaic also increases transparency and accountability,” she said.
“The Oaic continues to work with entities to ensure compliance with the scheme, offer advice and guidance in response to notifications, and consider appropriate regulatory action in cases of non-compliance.”
The risks of data breaches were greatly reduced when staff received regular training for handling personal information and when strong password protection systems were in place, Oaic found.
A research fellow with the University of Melbourne law school, Dr Megan Prictor, said it was concerning that health services were at the greatest risk of data breaches. She said the health sector still relied more heavily than most on paper records, which meant it was prone to breaches through human error.
“It still relies of paper-based records and unsophisticated systems, and a lot of health clinics and hospitals still rely on fax machines and sending documents back and forth,” she said.
“You would hope some of those breaches through human error will be reduced with the introduction of systems like My Health Record,” she said. “On the other hand having a massive rich data set in one location makes the record attractive to cyber criminals. Because of that the system will be highly protected. Not perfectly protected, but highly.”