5 November 2026 - For Immediate Release
Within 48 hours, a Qantas technology supplier and NSW Health were both hit by cyber incidents. The Australian Computer Society (ACS) is calling on governments to require independently verified cyber capability for the people who protect essential services.
NSW Police are investigating the NSW Health incident, which has been declared a "major incident." A hacker claims to have taken 100,000 documents through a misconfigured subdomain. That claim has not been verified, and Cyber Security NSW says no patient data has been impacted at this time.
ACS CEO Dr Prins Ralston said: "A misconfigured subdomain isn't sophisticated espionage. It's the digital equivalent of leaving a side door unlocked. If the claim is confirmed, it shows that basic security hygiene, and the skills of the people responsible for it, are still the weak point. We wouldn't let an unqualified engineer sign off a hospital's fire systems. Patient information deserves the same standard."
Tom Cleary, moderator of the APS cyber community and member of the ACS Accreditation Committee, said: “Domain misconfigurations are common mistakes with unfortunately serious consequences. Remember, attackers know what to look for. We should expect the people securing these systems to get the basics right and identify gaps before attackers exploit them.”
Dr Ralston welcomed Health Minister Ryan Park's openness that the investigation is live and the situation may change. He also endorsed Transport Minister John Graham's description of the incident as a wake-up call.
"Australians have had enough wake-up calls. What we need now is evidence that controls are working, recovery plans have been tested, and the people in charge have verified skills," he said.
"We need to move on this now," Dr Ralston said.
ACS is calling on the NSW and federal governments to:
- Require independently certified cyber professionals in roles that protect essential services and sensitive data.
- Publish regular, independent testing of security controls and incident recovery in health agencies.
- Adopt the national cyber capability standards being developed through the ACS-led CyberPath pilot, which has drawn on more than 2,000 engagements across the cyber community.
Having worked across commercial and public sector organisations of all sizes, including restricted environments, Mr Cleary said a common mistake was relying on “security theatre”: controls that sound impressive but do little beyond creating the appearance of protection.
“Shouting and waving hands won’t improve security. Decision-makers need to understand the risks, where the gaps are and what needs to change. That’s how we reduce costly cyber mistakes.”
The CyberPath pilot starts in February. Employers and cyber security practitioners can register as early adopters at https://www.cyberpath.org.au/get-involved/MVP.html
ENDS
Further information
Troy Steer
Director of Corporate Affairs and Public Policy
M – 0417 173 740
E – troy.steer@acs.org.au
About ACS
The Australian Computer Society (ACS) is the professional body for Australia’s technology profession. Since 1966, we have championed a trusted, skilled, and world-class profession, representing 42,000 members across business, government and education, with branches in every Australian state and territory. Our work strengthens Australia’s digital sovereignty, responsible AI adoption, cyber resilience, workforce capability and digital trust. We set professional standards, accredit education, certify practitioners and advocate for the skills and capabilities Australia needs. ACS is committed to advancing the profession and ensuring technology serves Australia’s national interests and delivers lasting public value.
About Cyberpath
CyberPath is a Commonwealth grant-funded cyber professionalisation pilot led by ACS which brings together industry, government and education to standardise career and education pathways, skills requirements and recognition frameworks for cyber security.