Peter A Clarke

Cyber attackers have hit Melbourne’s Catholic Archdiocese, demanding a ransom from the church and paralysing its computer system for days, while Australia’s biggest corporate superannuation fund, TelstraSuper, has admitted it has also been targeted.

The Age has confirmed the attacks, after revealing on Wednesday that a cyber crime syndicate hacked and scrambled the files of Melbourne Heart Group, a cardiology unit based at Cabrini Hospital.

Car maker Toyota has also been hit by a cyber attack in Australia, with employees locked out of their emails for days. Toyota Australia’s servers were targeted on Tuesday and an investigation involving federal authorities is under way into who was behind the potentially malicious cyber attack.

The Melbourne Catholic Archdiocese breach took place in late November, when hackers infiltrated the church’s IT system using “ransomware”, a type of attack which can threaten to publish the victim’s data or block access to it unless money is paid.

An Archdiocese spokesman confirmed to The Age that the attack had taken place, but said the church had been able to “isolate its impact” and progressively restore services.

“We have not engaged with the ransomware issuer and obviously, no ransom has been paid,” he said.

Led by Archbishop Peter Comensoli, the Archdiocese of Melbourne has more than 200 church parishes, 331 schools and 10 Catholic hospitals.

However, it is understood that the impact was contained to the church’s internal IT system, and did not affect, for example, sensitive data relating to the schools overseen by the church’s education arm, which runs on a separate network.

Australia’s largest corporate superannuation fund TelstraSuper has also been “the subject of attempted cyber attacks over the years”, a spokeswoman has confirmed.

Sources said one attack at TelstraSuper happened in 2016 and left staff scrambling to re-process data lost between the incident and an emergency backup. 

A spokeswoman for TelstraSuper said it had never paid a ransom, and had security systems that “proactively monitor threats” to the data of its 95,000 members

TelstraSuper is a fund open to former and current Telstra employees and some members of their families, with investments of more than $20 billion.

This week it became known that Australia’s political parties suffered cyber attacks alongside the Parliament House computer network several weeks ago by a “sophisticated state actor”. Cyber security experts believe China is a chief suspect.

After The Age’s  reporting of the Melbourne Heart Group breach, Cabrini Hospital sought to stress that none of its patient data had been compromised in the MHG attack, because both are separate entities. MHG paid a $10,000 ransom to regain access to its patients’ files.

MHG runs software provided by Genie Solutions. A spokeswoman for Genie Solutions said it “did not have control over the security measures taken to protect [its] customers’ networks”.

Genie Solutions described itself as the “market leader for medical specialist practices in Australia”, with more than 4000 customers using its medical practice management software.

A Victorian Department of Health and Human Services spokesman said no public hospital in the state had been impacted by a cyber attack via the MHG incident.

The state government allocated $33.9 million over the past three years for public health services to replace “at-risk” technology.