14 DAY TRIAL // NSW Health is the latest Australian government agency to confirm it has been affected by a security vulnerability in the Accellion File Transfer System, according to ZDNet.
New South Wales Health has announced it has been affected by a cyberattack affecting Accellion's file transfer technology. According to the government institution, the system was being used to share and store files by organizations around the world, including NSW Health, on Friday afternoon.
NSW Health said in a statement that "Following the NSW government's advice earlier this year around a worldwide cyber attack that included NSW government agencies, NSW Health is notifying people whose data may have been accessed in the global Accellion cyber attack".
According to the state institution, medical records in public hospitals were not affected and the software in question is no longer used. They also pointed out that the stolen data included several types of information, such as identifying information and, in certain cases, health-related personal information.
NSW Health said it was working with NSW Police and Cyber Security NSW and that there was no evidence that the information had been misused to date. Strike Force Martine was formed by NSW Police Force and Cyber Security NSW to assess the impact of the Accellion attack on NSW government agencies.
File Transfer Appliance flaws led to data breaches in many organizations
File Transfer Appliance, an Accellion enterprise product, is a file sharing tool used to transfer large files. While the older program is no longer supported and has been replaced by other software such as Kiteworks, a zero-day vulnerability in the older software was discovered in December and has already been exploited by attackers in the field.
To put it simply, the security breach is believed to have affected about 100 organizations worldwide. In January, Accellion was also used as a vector to break into the Reserve Bank of New Zealand (RBNZ).
The Australian Securities and Investments Commission (ASIC) announced in January that one of its servers had been compromised earlier this month in connection with Accellion software, that the agency uses to move data and attachments.