The Tasmanian government has confirmed that the data breach it suffered compromised the sensitive personal information of thousands of parents and students.

In February, security researcher Brian Krebs revealed on Mastodon that GoAnywhere MFT, a popular file transfer application, featured a zero-day vulnerability that enabled remote code injection. Krebs pasted the company’s security advisory that warned existing customers about the bug and the precautionary measures they could take to prevent exploitation.

The Clop ransomware group exploited the zero-day vulnerability to the hilt, compromising at least 130 organisations worldwide. Last month, the ransomware group added the City of Tasmania to its data leak site along with several other companies and municipalities.

In a recent press conference, Madeleine Ogilvie, the Minister for Science and Technology, said that the threat actors have leaked the stolen documents on the dark web. The trove of data leaked contains at least 16,000 documents of student levies, names, addresses, dates of birth, school account numbers of parents, and more.

Minister Ogilvie also said that the ministry has set a hotline number – 1800 567 567, for individuals to contact if they have any queries regarding the data breach.

“My concern is for individual students, parents; we need to triage that; we’ll be working through that. If you see any activity that’s unusual, your bank statements … please bring it forward, bring it forward to the authorities, contact the Australian Cybersecurity Centre, or come directly to us through our number.

“It’s a terrible thing. It’s a crime. And it is a global problem that we’re dealing with. I’m very, very concerned, and I have the deepest amount of sympathy and empathy for those who have been unwittingly captured in these document releases,” Ms. Ogilvie said.

“The particular incident was over … four days. A patch was applied, and that problem was remedied. What we’re dealing with now is information that was transferred during that window,” she added.

Several opposition leaders have, however, criticized the way Ogilvie has responded to the data breach and claimed that the Ministry has downplayed the severity of the security incident.

Shadow minister for ICT, Science and Technology, Jen Butler said, “It is no surprise that we have the worst cyber security in the country given the cuts to funding made by the Liberal Government, starting in 2014. Tasmanians deserve to know exactly what is going on, and Tasmanians deserve a Government that ensures their sensitive data is protected.

“Instead, Madeleine Ogilvie failed to secure Tasmanians’ personal data and then spent a fortnight concealing the truth about just how serious this data breach was. Her conduct has been unforgivable,” Butler added.