Nigerian scammers try to hack Noosa Council email
NIGERIAN scammers have penetrated Noosa Council's online systems but the council says no sensitive data has been compromised.
The breach, which occurred in late July, was revealed this week.
Noosa Council information and communications tech- nology manager Justin Thomas said scammers hacked the email of Queens- land Department of Premier and Cabinet director general David Stewart and then used the address to send emails, one of which went to Noosa.
"His mailbox was used to send an email probably to hundreds in his address book," he said. "It looked like a legitimate email from the director- general so a staff member opened it and it prompted for their email address and password which they supplied."
Mr Thomas said the council email account was then used to send the same malicious email to hundreds of recipients in the account's email address book.
Council staff secured the affected mailbox within 30 minutes of the email being sent, warning all recipients to delete the email or change passwords if they had opened the link in the email.
Mr Thomas said the computer breach was being investigated by police and the Queensland Government Cyber Security Unit had been provided with all details by the council staff.
Councillor Frank Pardon said the cost of the Noosa ICT "hiccup" was nothing compared to the "the cost of the hiccups to other councils, Brisbane City in particular".
"We got out of it very lightly," Cr Pardon said.
Brisbane City Council lost $450,000 to the scam. Sunshine Coast Council was also targeted but managed to avoid being stung.
Mayor Tony Wellington said the cyber deception meant "money at other councils had inadvertently gone overseas" .
Mr Thomas said the loss from Brisbane and some other councils was "more of a fraudulent activity".
"They contacted the council's accounts payable area and said 'I'm from such and such company, I need to change our bank details'."
Mr Thomas said staff changed the details so the scammers received the next payment meant for a company that had dealings with the council.
He said the incident highlighted the real and present ICT security risks from criminal organisations. Noosa council was up-grading security and providing more staff training.
"In December 2015 council contracted an ICT security company to undertake a systems penetration test including external websites," Mr Thomas said.
"This test involved attempting to gain access to council's systems remotely via technical weaknesses.
"The test and the resulting recommendations were used to improve the security of council systems and were reported to council's audit and risk committee.
"A second security review of council's ICT internal security was conducted by the same ICT security company in July 2016."
This has resulted in new security software using a software system to manage mobile devices and testing of psychological manipulation of staff by cyber "social engineering".
"The Queensland state government announced the creation of a new $12.5 million cyber security unit in February this year, highlighting the importance of ICT security and the associated risks of cyber-attacks," Mr Thomas said.
"The unit provided valuable information to council during the recent malicious access to state government mailboxes."