Access to more than 3600 MyGov accounts is being sold on the dark web, potentially exposing thousands of Australians to fraud and identity theft.
The MyGov accounts are among a list of more than 150,000 compromised “.com.au” logins available for sale on the dark web, where logins are being sold for anything from a few minutes to several hundred dollars.
MyGov, which was launched in 2013, acts as a gateway to a range of sensitive government services, including the tax office, Centrelink, Medicare, the National Disability Insurance Scheme and My Health Records.
“Each subscription service has its own fraud detection capabilities,” said the Australian agency’s general manager Hank Jongen, adding that the services had to be linked to a person’s MyGov account to be accessible.
Mr Jongen said that while he would not comment on "specific cyber operations", Services Australia was "provided with information indicating ongoing activity on the dark web".
The compromised accounts were identified by Israeli intelligence firm KELA, which specializes in dark web threat intelligence.
KELA's head of intelligence, Elad Ezrahi, said the MyGov accounts were extracted from more than 2,000 compromised computers or "bots.".
“The threat actors behind these platforms likely obtain this data either by running their own botnet … or by purchasing stolen credentials from other actors,” Mr. Ezrahi said.
The data can be used by an attacker for various malicious activities, depending on the attackers' motivations.
“For example, an attacker who purchases a bot, with compromised accounts for the my.gov.au portal, can use the victim’s data for identity theft and to carry out various fraudulent activities.”
Mr Jongen said if people suspect their MyGov accounts have been compromised, they should contact the Scams and Identity Theft Helpdesk.
“This group can quickly revoke an account and disconnect member services to prevent further access,” he said.
The logins seen by The Australian Financial Review include banks, government agencies, telecommunications and e-commerce. The most recent data was from late May 2020. For legal reasons, no data was purchased to confirm authenticity.
The COVID-19 has proven beneficial for hackers as millions of employees work remotely, with intelligence firm Cybel reporting that more than 500,000 Zoom accounts are available for sale online.
The average prices for a range of products for sale on the dark web are as follows: fake passports ($1500), driver's licenses ($550), credit cards ($35) and emails ($55).
Australia's Australian Cyber Security Center issued a warning in November reporting an increase in the use of botnet-related malware
