{"id":565070,"date":"2026-03-26T06:37:11","date_gmt":"2026-03-26T06:37:11","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/565070\/"},"modified":"2026-03-26T06:37:11","modified_gmt":"2026-03-26T06:37:11","slug":"government-entities-in-queensland-unaware-of-cybersecurity-vulnerabilities-audit-office-report-finds","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/565070\/","title":{"rendered":"Government entities in Queensland unaware of cybersecurity vulnerabilities, audit office report finds"},"content":{"rendered":"

A cybersecurity audit has gained the “highest level of access” to two government entities in Queensland, highlighting serious gaps in the systems.<\/p>\n

The auditor-general tested the effectiveness of a state government, local government, and statutory body’s IT security controls.<\/p>\n

Its report noted the entities did not know “how vulnerable” they were to third-party cybersecurity threats.<\/p>\n

“In each of the entities, we were able to obtain passwords, access systems, and extract sensitive information outside the intended scope of a third-party user,” the report said.<\/p>\n

“For two of them, we were able to bypass controls and gain the highest level of access to their IT environments.”<\/p>\n

The report found increasing frequency and sophistication of cyber attacks could expose entities that had weak cybersecurity.<\/p>\n

“Entities that do not manage these risks effectively may experience a cyber attack through a third party, leading to a loss of privacy, financial cost, reputational damage, and other ramifications.”<\/p>\n

As a result of the lack of mitigation controls, the auditor-general noted the entities could not understand the extent of their supply chain risks.<\/p>\n

Contracts were also found to be a significant security gap.<\/p>\n

“Only two of 36 contracts we reviewed included requirements for third parties to report their cybersecurity incidents and vulnerabilities,” the report said.<\/p>\n

“This means that entities can have risks that they are unaware of and therefore cannot effectively manage.”<\/p>\n

Risks raised five years ago<\/p>\n

The auditor-general also assessed how the Queensland government’s housing department, customer services and open data department managed cybersecurity risks in the public sector.<\/p>\n

Queensland councils scammed out of millions despite warnings<\/a><\/p>\n

A year after Gold Coast Council was victim to a fraud attack, Noosa Council was also targeted by a sophisticated artificial intelligence scam.\u00a0<\/p>\n

It found the latter was not actively assessing or monitoring third parties’ cyber capability.<\/p>\n

“CDSB [Customer Services, Open Data and Small and Family Business department] has begun building capability across the public sector to manage third-party cybersecurity risks, but needs to do more to be effective,” the report stated.<\/p>\n

The report noted the Commonwealth’s cybersecurity agency had flagged risks since 2021.<\/p>\n

“The Queensland government has been slow to develop a framework to help entities manage their third-party cybersecurity risks,” it said.<\/p>\n

The auditor-general made several recommendations, including that all public sector entities and local governments review and update their IT systems, improve identification of suspicious activity, and strengthen contract management practices.<\/p>\n

Local Government Minister Ann Leahy said her department would write to each council to “emphasise the importance of implementing the recommendations”.<\/p>\n

\"A<\/p>\n

Ann Leahy says her department will write to each council to “emphasise the importance of implementing the recommendations”. (AAP: Darren England)<\/p>\n

“However, I note that there are potential resourcing and capacity implications for some councils, particularly smaller or resource-constrained councils, associated with implementing enhanced governance and reporting,” she said.<\/p>\n

Director-general of the housing and public works department, Mark Cridland, said his team was committed to working to mature capability in identifying and managing third-party cybersecurity risks.<\/p>\n","protected":false},"excerpt":{"rendered":"A cybersecurity audit has gained the “highest level of access” to two government entities in Queensland, highlighting serious…\n","protected":false},"author":2,"featured_media":296445,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[278249,64,63,99,53556,43851,2458,278248,94,701,109777,15878],"class_list":["post-565070","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-ann-leahy","tag-au","tag-australia","tag-business","tag-cyber-attacks","tag-cyber-security","tag-data","tag-it-systems","tag-qld","tag-queensland","tag-queensland-audit-office","tag-queensland-government"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/565070","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=565070"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/565070\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/296445"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=565070"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=565070"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=565070"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}