Courts reveal true scale of cyber attack on system

The cyber attack that hit Victoria’s court system was worse than officials first thought, with hackers potentially accessing years’ worth of recorded hearings.

Court Services Victoria was made aware of the infiltration on December 21 and initially believed hackers might have accessed hearings from the Supreme, County, Magistrates and Coroners courts as far back as November 1.

It also warned an October recording from the Children’s Court could have been compromised.

But CSV on Thursday revealed some of the files hacked were from as far back as 2016.

Hackers gained access to Supreme Court matters heard in Ballarat in April that year, along with others heard in Bendigo, Shepparton and Wodonga during parts of 2023, the statement said.

The hack also covered Supreme Court matters held in Melbourne’s County building across six months in 2023.

Court officials previously thought the cyber attack only covered County matters dating back to November 1 but it in fact covered hearings there from April 4 to 6, 2016.

The hackers accessed more than four years’ worth of County recordings dating from May 28, 2019 to January 1, 2023, CSV said.

Officials initially thought the hack covered County matters back to November 1. (Mal Fairclough/AAP PHOTOS)

“In many courts the system typically holds recordings for around 28 days, so the primary investigation period initially was 1 November to 21 December, which is when CSV identified the problem and isolated and disabled the affected network,” chief executive Louise Anderson said in a statement.

The updated date range for Coroner’s matters was from August 5, 2019 to December 21, 2023.

CSV discovered the hack was worse than previously thought after January 5, when it was able to analyse devices.

Staff would continue to alert people whose hearings at the Supreme, Magistrates, Children’s and Coroner’s courts had been hacked but would focus on “particularly sensitive” County matters given the volume of affected cases, a statement said.

“Please be assured CSV and the Courts continue to work on this process as a matter of priority,” it said.

“CSV is not currently aware of any unauthorised publication of the recordings.

“Monitoring of this will continue.”

There was no change to the date range for the Magistrates Court, where targeted matters dated to November 1.

The Children’s Court and Victorian Civil and Administrative Tribunal were unaffected.

It’s now believed the children’s court was not affected. (Daniel Pockett/AAP PHOTOS)

The source of the hack has not been officially confirmed.

Cyber security expert Mohiuddin Ahmed said it was likely hackers socially engineered a court staffer, breaking into their computer system through a weak password.

“(The hackers) are sitting there doing nothing – just observing everything going on,” the Edith Cowan University lecturer told AAP.

“They’re trying to find out what is the most sensitive and private data which could give them the maximum benefit if they sell it on the dark web.”

It was key for the court to quickly address how the attack happened and beef up security, Dr Ahmed said.

But it was also important that ongoing security was not compromised.

“For the sake of doing it faster, you might be tempted to hire a lot of people,” Dr Ahmed said.

“But if those people are the insider threats, if those people are compromised, then there’s no point doing this as quickly as possible.”

Authorities should also monitor the dark web for hackers trying to sell accessed court recordings, Dr Ahmed said.