Cyber security incident involving OracleCMS

Latrobe City Council have been notified of a cyber security incident involving OracleCMS, a contracted service provider provider who manage customer calls to Council outside of business hours.

On 12 April 2024, OracleCMS became aware that data had been stolen from its network. This became known following identification that an unauthorised third-party accessed their systems.

Latrobe City Council were provided with the complete information contained in the data breach by 17 May 2024 and undertook an extensive review of the data.

Upon investigation, Latrobe City Council have identified the personal information that was impacted in the data breach and all affected customers have been notified.

The affected data is limited to what is known as ‘low risk identity attributes’ and relates to personal information such as individuals’ names (first and last name), physical addresses (at the time of speaking to the After-Hours provider, OracleCMS), phone number, and nature of the call. The information affected relates to data from 2013 and 2015.

Latrobe City Council systems were not compromised or impacted by this incident.

OracleCMS is a specialised third-party supplier who supports Council in responding to calls made to Latrobe City Council’s Customer Contact Centre after hours and at other times as needed.

OracleCMS is used by many councils across Victoria, and we understand this incident is affecting a number of organisations including other councils. 
For further information on OracleCMS, please visit their website at www.oraclecms.com
 

OracleCMS has partnered with external cyber security experts to support its response to the incident.

OracleCMS and its cyber incident response partners are working closely with Commonwealth and State government agencies, including privacy regulators and law enforcement agencies to investigate, monitor and respond to the data breach.

Our contract with OracleCMS requires them to apply stringent privacy and data protection measures, including a requirement to protect government data against unauthorised access and misuse.

More information on OracleCMS response to the cyber incident can be found at https://www.oraclecms.com/news/
 

Latrobe City Council has partnered with IDCARE, Australia’s national identity and cyber support community service.

Affected individuals have access to contact IDCARE, at no cost to the individual, who provide general advice and guidance on how you can reduce the harm associated with the release of personal information. 

It is important to note Latrobe City Council will never contact you to ask for usernames or passwords.

If a third party may have accessed your contact information, it is important to:

• Be aware of telephone and text-based scams.
• Do not share your personal information with anyone unless you are confident about who you are sharing it with.
• If you are asked to login, check the web address located in the address bar and if you are suspicious contact the entity through the usual channels to ensure you
• are logging into a legitimate website.
• Don’t click on links in emails or SMS claiming to be from OracleCMS.
• Don’t give your details to someone who calls about the breach and claims to be from OracleCMS.
• Don’t share your password or give remote access to your computer or other device.
• Report scams that relate to this breach at Scamwatch www.scamwatch.gov.au.
• Enable multi-factor authentication for your online accounts where possible, including your email, banking, and social media.
• Ensure you have up-to-date anti-virus software installed on any device you use to access your online accounts.
• Check the strength of your passwords.

Latrobe City Council take the security of our customers information very seriously and have the following measures in place to secure data and information systems.

• Firewalls and other network security controls to protect against unauthorized access.
• Encryption of sensitive data.
• Access controls and user authentication mechanisms.
• Regular software updates and patches to address known vulnerabilities.
• Backup and disaster recovery processes to ensure business continuity.
• Security awareness training for employees to mitigate human-based risks.