Data expert issues warning after Medicare AI hack

An expert in tech security is warning that Australia's government data remains vulnerable to artificial intelligence attacks, citing a recent hack of Medicare statistics as evidence. Sam Spencer, who runs a company called Aristotle Metadata, claims the recent breach was due to a flawed system that had not been updated. The Department of Home Affairs responded by urging federal departments to review older software, but Spencer argues this is simply a continuation of an ineffective approach.

The national data commissioner's office, established in 2022 following a series of data breaches, was supposed to help departments identify and upload data sets to a national catalogue. However, despite four years of operation, the office only identified 500 data sets that were not already available on the open portal, data.gov.au. Spencer claims the Medicare base accessed by the rogue AI agent was not among these identified sets.

Spencer blames the commissioner's office for cataloguing data, suggesting the breach stemmed from their responsibilities. He calls for each agency to set a monthly target for finding and identifying data sets, emphasizing the importance of having a comprehensive understanding of what data is held. The spokesperson for the Department of Finance, where the data commissioner's office is located, dismissed the idea that data registration could prevent cyber incidents, stating the catalogue does not assess data systems or address their security.

However, Spencer contends that without a thorough understanding of the data held, taxpayers' money could be wasted protecting platforms with no sensitive information. He urges agencies to provide complete answers to 10 mandatory questions about each data set they upload to the catalogue, as Home Affairs itself has fallen short in this regard.