Transcript: Doorstop - Parliament House

4 July 2017

The Hon Alan Tudge MP

Minister for Human Services
Topics: 
Medicare data breach
E&OE

ALAN TUDGE:
I will just make some brief comments this afternoon in relation to the claims made in the Guardian newspaper article this morning that some Medicare card numbers were for sale on the internet.

Firstly, can I say that we take such claims very seriously. Indeed we already have an internal investigation under way and we have referred the matter to the Australian Federal Police for possible criminal investigation.

The second point I would make is, what is being claimed is that Medicare card numbers alone have been obtained. This is a very important point, nobody’s Health Records can be accessed just with a Medicare card number.

Anybody who suggests otherwise is irresponsible and is fear-mongering. That is exactly what the Labor Party has been doing today. Tanya Plibersek herself, used to be a Human Services Minister. She knows exactly what the situation is. And that is no one’s Health Records can be obtained just with a Medicare card number.

The third point I would make is that the report suggests that the numbers involved are very small and there is no indication that there has been a wide scale breach.

The final point I would make is that the advice I have received from the Chief Information Officer in my Department is that there has not been a cyber security breach of our systems, as such, but rather it is more likely to have been a traditional criminal activity.

As I said, we have referred the matter to the Australian Federal Police and they will get to the bottom of all of this.

I am happy to take a few questions, but bear in mind there is a limited amount I can say in relation to this matter.

JOURNALIST:
When it comes to scale, how can you account for the fact that the one journalist’s request was successful? That would be suggestive, wouldn’t it, of a large number of files being accessible?

ALAN TUDGE:
I am not going to comment on that because it is being referred to the Australian Federal Police. I will simply say that the advice I have received from our Chief Information Officer is that there has not been a cyber security attack on our systems as such, that it is more a traditional criminal activity.

JOURNALIST:
Are you suggesting the actual breach is somebody has a friend sitting in a doctors surgery or a hospital that is able to access that database across the board?

ALAN TUDGE:
I am not going to make comment on that, and I am sure you can understand why.

JOURNALIST:
When did you or the Department notify the AFP about this matter?

ALAN TUDGE:
Yesterday when we became aware of it.

JOURNALIST:
So you became aware of it…

ALAN TUDGE:
We became aware of the allegation yesterday and the AFP was informed immediately.

JOURNALIST:
Only after the Guardian asked you?

ALAN TUDGE:
They are allegations and we have referred them to the Australian Federal Police who will investigate them.

JOURNALIST:
The reporter who wrote the story was on Twitter about an hour and a half ago and suggested he had been contacted by the Department of Human Services to let him know that his data had been breached.

Is that an indication that the Department has identified the source of the breach and is ringing everybody that may have been a victim of it?

ALAN TUDGE:
That is usual practice that that occurs. If the Department believes someone’s Medicare card has been compromised, they will be contacted by my Department and informed and I presume the journalist has been informed about this in line with standard practice.

JOURNALIST:
Who is responsible for checking this data if it is out there and why wasn’t it picked up sooner?

ALAN TUDGE:
The allegations were made yesterday and they were immediately referred to the Australian Federal Police. As I said, the suggestions are that the numbers are very small and we are talking about the acquisition of Medicare card numbers only.

And as I said early, nobody’s Health Records can be obtained just with a Medicare card number.

I will just take one or two more questions.

JOURNALIST:
How many people do you estimate has been affected?

ALAN TUDGE:
The report indicated that the numbers are very small.

JOURNALIST:
I think it suggested 75 files sold since October. Following on from your earlier answer, does that mean that 75 people have now been contacted by your Department?

ALAN TUDGE:
I am not aware of how many people have been contacted by the Department. I do know that the report indicated that the numbers are very small and there is no indication of a wide-spread breach.

JOURNALIST:
This data being available for sale since October last year, does no one at DHS monitor these sites?

ALAN TUDGE:
When we are made aware of any such allegation or breach, the Australian Federal Police is informed immediately.

Thank you.