New Zealand police called in after mass hacking attempt on 'wellbeing' budget

https://www.theguardian.com/world/2019/may/29/new-zealand-police-called-in-after-mass-hacking-attempt-on-wellbeing-budget

Version 0 of 1.

New Zealand police have been asked to investigate after the Treasury office said its systems were hacked in an attempt to reach documents on the forthcoming budget, in the biggest cyber security scandal to hit parliament.

Billed as the world’s first “wellbeing budget” – putting wellbeing of New Zealanders at the forefront of fiscal spending – the document was scheduled to be officially released on Thursday.

But late on Tuesday, the Treasury office said it had gathered sufficient evidence that its systems had been “deliberately and systematically hacked”, with more than 2,000 attempts recorded over a 48-hour period from Sunday.

Treasury secretary Gabriel Makhlouf said the hacks had been referred to the police after consultation with the National Cyber Security Centre.

“The Treasury takes the security of all the information it holds extremely seriously,” said Makhlouf, adding that the annual budget release would go ahead as planned on Thursday.

“It has taken immediate steps today to increase the security of all budget-related information and will be undertaking a full review of information security processes. There is no evidence that any personal information held by the Treasury has been subject to this hacking.”

News of the hack came after the opposition National party released some details from the budget on Tuesday.

Finance minister Grant Robertson described the hack as “extremely serious” and said he had contacted the National party requesting it desists from releasing any more budget documents, because they could have been sourced from the hack.

National party leader Simon Bridges said his party had acted “entirely appropriately” and the government was “lashing out in a witch hunt” by inferring the leaked documents obtained by National could have been the result of the hack. Bridges called for Robertson to resign.

“There has been nothing illegal or anything approaching that from the National party,” he said.

Refusing to say how National obtained the documents, Bridges said the incident was the result of a “bungling and incompetent” Labour coalition government that was looking for scapegoats.

“It’s amateur hour,” said Bridges. “The reality is they are incredibly embarrassed, they are not in control of what they are doing.”

Technology commentator Paul Brislin told local media the hacks could have originated from New Zealand or overseas, and the repeated and multiple attempts proved it was a “deliberate attack”, and suggested automation, such as a bot.

“It could have come from anywhere in the world,” said Brislin. “Whether this is the Treasury website being attacked or whether it is the Treasury core computer system being attacked, I am not sure yet which of the two scenarios this is.”

He told the Guardian that a third party was most likely responsible.

“They called in the police on advice from the National Cyber Security Centre [part of spy agency the Government Communications Security Bureau] which has access to tools and resources far beyond the usual corporate security level. That would suggest a real threat.”

The Labour coalition government’s 2019 wellbeing budget has generated significant national and international interest. The government has billed it as a world-first, putting mental health, domestic violence and child poverty at the forefront of all its spending decisions.