Australia orders government-wide cyber review after OpenAI's Medicare breach

Australia's Home Affairs department has directed all government departments and agencies to conduct a "rapid" stocktake of legacy IT systems after OpenAI was linked to a data breach involving the Medicare website.

Under the directive, agencies must develop risk-management plans for outdated technology and report their compliance back to the department. Priority has been given to systems of government significance — the most critical infrastructure — with a review due by the end of the year, while assessment of other systems must be completed by the end of March.

Acting home affairs minister Richard Marles said artificial intelligence is "changing the environment in which we operate at extraordinary speed," adding that authorities cannot wait for an old system to fail before replacing it and must identify vulnerabilities before they can be exploited.

Signals directorate weighs in

Abigail Bradshaw, director-general of the Australian Signals Directorate, said that while OpenAI's apology over the breach mattered, the more significant development is the "substantive" steps the company plans to take to better protect sensitive information going forward. OpenAI apologised for the breach and said an executive will appear before parliament next week to address the incident and prevention measures.

Bradshaw said the directorate has spent the past six months working to strengthen sensitive networks — including those of financial institutions, health bodies and energy providers — using models not available to the public, which allowed vulnerabilities in code to be identified and patched quickly before the rollout of an important national process.