There are about 8000 "potentially malicious exploitation attempts" on the ATO's website each week, and the agency has been praised for its transparency around the data.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
The Australian Tax Office website has about one billion connections in a working week, the agency has told a Senate inquiry, with only about 60 per cent of those legitimate attempts by users to engage with the tax office. The other 40 per cent are mostly "attempts to test the protective layers of ATO systems", while the 8000 potentially malicious attempts are just 0.001 per cent of the website's connections.
Managing director of the Centre for Internet Safety Nigel Phair said that number was about what should be expected of a "big juicy target" like the ATO.
"In realistic terms it's the percentage that counts, it is quite low," he said.
"I'd put it down as business as usual."
The tax office has been one of the major targets in an inquiry looking into stuff ups in the government's digital services, after its website faced a series of outages in 2016 and 2017. Tax office officials revealed that outages in December 2016 and February 2017 were due to the failure of fibre optic cables that had been designed to prevent problems in other hardware from bringing down the whole system.
Mr Phair said government websites needed to balance keeping users' data secure while also being easy and efficient to use. Government departments were a prime target for hackers.
"You could say the same with Human Services, the Department of Health, you could say Department of Defence, those big juicy targets, people are going to have a pot shot at them whether they are ultra hardened criminals or just people out there thinking 'this looks like a target I'll see how I go'."
The tax office told senators it kept statistics on "cyber-related activity" and reported on it weekly and monthly.
"The majority of these attempts are rendered ineffective by system design and other security measures that are continually refined through the ATO’s security practices including its internal penetration testing activities," the tax office said.
Mr Phair said it was a positive sign the tax office could report the number of threats it faced.
"What I do like about this is that the ATO is able to accurately report on it which means they're collecting data and actively defending their networks," he said.
"I actually think it's a great thing from their maturity perspective that they actually know that because a lot of organisations wouldn't have that."
