{"id":913925,"date":"2026-10-02T21:54:14","date_gmt":"2026-10-02T21:54:14","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/913925\/"},"modified":"2026-10-02T21:54:14","modified_gmt":"2026-10-02T21:54:14","slug":"openais-medicare-attack-has-exposed-australias-tech-debt-fixing-it-could-bring-a-big-bill-for-taxpayers-australia-news","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/913925\/","title":{"rendered":"OpenAI\u2019s Medicare attack has exposed Australia\u2019s \u2018tech debt\u2019. Fixing it could bring a big bill for taxpayers | Australia news"},"content":{"rendered":"

The Australian government faces significant \u201ctech debt\u201d that could bring a big bill for taxpayers after the OpenAI Medicare breach<\/a>, as government agencies will need to fortify their defences against future attacks by AI agents.<\/p>\n

This week, the home affairs department ordered all federal government agencies to conduct a \u201clegacy technology stocktake\u201d that requires a plan for each agency to \u201creduce legacy technology systems\u201d to a level within the agency\u2019s risk tolerance and appetite, the direction stated<\/a>.<\/p>\n

OpenAI this week revealed<\/a> an internal agent had gained non-public access to the Services Australia Medicare statistics portal during a training task seeking information on government spending on skin conditions in Victoria. The agent was able to run commands, retrieve internal files, credentials, and write files.<\/p>\n

Sign up for the Breaking News Australia email<\/a><\/p>\n

While OpenAI<\/a> has apologised to Australia for the incident, it has served as a wake up call for the federal government, with the government-wide review now under way.<\/p>\n

The finance minister, Katy Gallagher, asked her department whether some of the A$160m funding allocated to the agency in the last budget for cyber upgrades can be accelerated.<\/p>\n

The statistics portal, Gallagher told reporters last month, is a \u201clegacy system.\u201d<\/p>\n

\u201cIt dates back decades.\u201d<\/p>\n

Services Australia will be far from alone in managing legacy systems. They can \u2013 but not all do \u2013 present a security risk for businesses and government as they age and vendors cease providing new security updates.<\/p>\n

Prof Salil Kanhere, a University of New South Wales cybersecurity and AI expert said the age of the system alone does not tell an agency whether it needs replacing.<\/p>\n

\u201cA 15-year-old system that is properly supported, patched and properly isolated would perhaps present less risk than even a newer system that might not be properly maintained,\u201d he said.<\/p>\n

Those older systems with vulnerabilities are often known to human attackers, but AI agents persistent in looking for holes in a system may be able to discover them quicker.<\/p>\n

\"RogueRogue AI hacks government system for first time – The Latest<\/p>\n

Gartner, a technology analysis firm stated in a note to clients released after the Medicare hack that \u201ctechnical debt, not a rogue AI agent attack\u201d represented the greatest threat to legacy systems.<\/p>\n

\u201cAgentic AI\u2019s interactions with [government] resources will greatly increase,\u201d the firm stated. \u201cUnderinvestment is no longer sustainable and agencies should urgently prioritise funding in light of AI-driven risks.\u201d<\/p>\n

In the Australian government\u2019s commonwealth cybersecurity posture in 2025 report released in February this year<\/a>, 59% of federal agencies and departments reported their ability to implement the \u201cessential eight\u201d measures to reduce cyber risk was being affected by use of legacy technologies.<\/p>\n

The essential eight includes requirements to patch applications and operating systems, using multi-factor authentication, and other security measures. Of those agencies being hindered by legacy tech, 34% blamed insufficient dedicated funding, while 18% said it was due to a lack of a viable replacement.<\/p>\n

Prof Yang Xiang, from Monash University\u2019s department of software systems and cybersecurity, said the government stocktake was \u201cvery necessary\u201d and there was urgency to needing to audit all government systems.<\/p>\n

\u201cThe agents bring significant changes in terms of the speed of getting into \u2013 hacking into \u2013 the system,\u201d he said. \u201cThe cost to launch an attack is much reduced to launch an attack and with the help of agents, it is fairly easy for the hacker to launch a very large scale atack against any systems.\u201d<\/p>\n

skip past newsletter promotion<\/a>Free newsletter |When needed<\/p>\n

Sign up to Breaking News Australia<\/p>\n

Get the most important news as it breaks<\/p>\n

\"\"<\/p>\n

Clearing the tech debt could prove costly for the federal government, but Xiang said agencies should identify priority systems for replacement. Kanhere said high-risk systems should take priority.<\/p>\n

\u201cYou do the high risk stuff first, I think it is absolutely needed, and then put the perimeter around [other systems],\u201d he said. \u201cIt is possible to do it quite systematically once they have a good understanding of what needs to be done.\u201d<\/p>\n

Some states have audited their legacy technology and have invested hundreds of millions to rectify the issues.<\/p>\n

A Victoria government cybersecurity audit<\/a> of its IT servers found 25% of the operating systems used by servers were no longer supported by the vendor, with 48% in extended support.<\/p>\n

In a South Australian audit report of legacy ICT systems<\/a> published in June, of the ten agencies reviewed, nearly half of the 11,602 hardware devices or appliances were determined to be legacy devices. Almost one quarter of the operating systems and applications were also determined to be legacy.<\/p>\n

In one example, the Department for Child Protection\u2019s case management system is now over 15 years old, and has limited vendor support.<\/p>\n

The SA government has allocated $325.6m over the past three budgets in part to address legacy technology.<\/p>\n

\u201cFrontline workers spend significant time managing system limitations and maintaining records, reducing the time available to support vulnerable children and families.\u201d<\/p>\n

A 2025 Queensland government audit of IT systems<\/a> found more than half of the 57 systems audited are at the end of life. Many of the systems identified by the government in 2012 as needing to be replaced were still in operation in 2025, including a patient administration system at Queensland Health, a forensic register at the Queensland Police Service, and a trust accounts system for young people in detention.<\/p>\n

The Queensland government in the 2025 budget allocated $1bn over four years for IT investment, including replacing or updating legacy systems.<\/p>\n

The Australian Cyber Security Centre said in recent guidance<\/a> that the most effective way to mitigate risks associated with legacy IT is to replace it, and where it cannot be replaced, then legacy technology should potentially be segregated or isolated from the broader department network to restrict access to the rest of the department.<\/p>\n","protected":false},"excerpt":{"rendered":"The Australian government faces significant \u201ctech debt\u201d that could bring a big bill for taxpayers after the OpenAI…\n","protected":false},"author":2,"featured_media":913926,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[64,63,44],"class_list":["post-913925","post","type-post","status-publish","format-standard","has-post-thumbnail","category-australia","tag-au","tag-australia","tag-news"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/913925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=913925"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/913925\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/913926"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=913925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=913925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=913925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}