The personal information of more than 8,000 staff and clients of a health organisation that services remote communities in Queensland was accessed in a cyber attack last year.
The Apunipima Cape York Health Council, an Aboriginal community-controlled organisation that services 11 remote communities in Far North Queensland, said an unidentified third party had viewed the information of patients, clients and staff during the incident in October.
The organisation, which has defended the length of time the investigation took, said the information accessed included Medicare numbers and, in some cases, copies of passports, tax file numbers, driver licences, bank and superannuation details.
Chief executive Deb Malthouse said a forensic investigation carried out by several government agencies, including the Australian Cyber Security Centre, had determined that none of the personal information stolen had been "misused".
She described the attack as "deeply distressing".
"We know that the information of around 8,000 people has been accessed," Ms Malthouse said.
"We are confident that nothing has been misused or is being held, based on the advice given to us.
"Some individuals have had nothing accessed at all."
Long wait for answers
The organisation said an unidentified third party had claimed responsibility for the hacking in a post on the deep web.
Ms Malthouse said those whose information had been accessed would be contacted in writing in the coming weeks.
She said the the organisation was working with Services Australia and the Australian Taxation Office.
"The advice from our cyber security experts has been the likelihood of information being misused is low," Ms Malthouse said.
"We are not recommending Medicare cards be replaced, in terms of driver licences — that's someone's own personal decision."
Lockhart River Aboriginal Community Mayor Wayne Butcher said many people in the community were clients of the Apunipima Cape York Health Council.
He said the incident was very concerning and questioned why it took five months to carry out the investigation.
"There are a lot of questions around why clients have not been kept updated since the cyber attack," Cr Butcher said.
"We have been wondering where it's got to and this is the first I've heard about an outcome."
Ms Malthouse defended the length of time it had taken to conclude the investigation.
"I know it's been five months, but unfortunately we are only a small Aboriginal organisation with limited resources, so we have to outsource these things," she said.
