The agency overseeing the National Disability Insurance Scheme (NDIS) has confirmed that “some” participants, prospective participants, their families, carers, and staff have been impacted by the recent HWL Ebsworth data breach.
The National Disability Insurance Agency (NDIA) had been investigating its potential exposure to the incident since last month.
In a recent statement, the agency issued an apology to those affected, expressing regret for any distress caused.
Although the NDIA’s internal systems remain uncompromised, HWL Ebsworth, an external law firm providing services to private clients and government agencies, including the NDIA, experienced the breach in April, when threat actors used ALPHV/BlackCat ransomware. The exfiltrated data was later published by the attackers.
Forensic investigators, along with the law firm, have been analyzing the leaked material, and it has been reported that approximately 40 government departments and agencies at the federal and state levels have been impacted in some capacity.
The government’s response to the breach is being coordinated through a new cyber security function within Home Affairs.
The NDIA assured that it is closely collaborating with HWL Ebsworth to identify, notify, and provide support to those affected as they determine the extent of the information compromised. Direct contact will be made with impacted individuals.
Only participants and prospective participants who have engaged with HWL Ebsworth are at risk of being affected, along with other associated individuals, according to the agency.
Taking precautionary measures, the NDIA is actively monitoring plans and account transactions to detect any unusual or suspicious activity related to the breach.
For those with concerns, the NDIA has set up a helpline reachable at 1300 216 807.
