QLD Customer Services dept: $809k loss from SMS toll-fraud cyber attack (Jul 2025) — disclosed in annual report (ABC 30 Sep)
ABC News (Sarah Richards, 30 September 2026) reports that Queensland’s Customer Services, Open Data and Small and Family Business department — which sets cyber security policy/guidance for the state public sector and manages whole-of-government cyber services — recorded an $809,000 public-money loss from an external cyber attack for financial gain in July 2025, disclosed in the department’s latest annual report. Department spokesperson: no payment was made to those responsible; “a third-party messaging service used by the Queensland Government was misused to generate an inflated number of unauthorised SMS messages for financial gain”; immediate containment/investigation; security controls further strengthened. Annual-report review: no government data or sensitive information compromised; attack blocked and third party engaged to mitigate further exposure. Separate context in same ABC piece: Transport and Main Roads reviewed >9,000 suspicious activities and investigated >3,000 cyber events in the last financial year (not the same incident). Primary: ABC 30 Sep; wire-primary until a dedicated departmental cyber notice URL is mirrored.
- Product
- Queensland Government third-party messaging / SMS service (product unnamed) — Customer Services, Open Data and Small and Family Business department
- Versions
- n/a — July 2025 incident; disclosed via departmental annual report (ABC 30 Sep 2026)
- Exploited in Australia?
- unknown
- Patch to
- No public CVE. QLD/gov operators: treat third-party SMS/messaging gateways as payment/toll-fraud surfaces — rate-limit, anomaly alerts on SMS volume/cost, least-privilege API keys, and vendor incident clauses. Confirm departmental annual-report / QAO follow-ups for affected entities. Distinct from data-exfiltration NDB cases (no personal info compromised per ABC).
Primary: ABC News — QLD Customer Services dept loses $800k in cyber attack (30 Sep 2026) · Vendor: ABC News (annual-report disclosure via QLD department spokesperson)