This audio is voiced by AI and may occasionally mispronounce words.
Share your feedback and help us improve this feature. Read more about how we use AI at SBS here.
Hacking attacks have become so common that keeping data safe feels like an impossible task, with some cybersecurity experts saying the system is "fundamentally broken".
Mihai Lazarescu worked for years as a 'white hat' hacker finding vulnerabilities in computer systems, and says organisations simply don't have the resources to effectively manage the threats.
The cyber security consultant, who is an associate professor at Curtin University, says news this week that Australia's Medicare statistics portal was hacked — the first known hack of an Australian government website by an agentic AI agent — is another example of the challenges involved in keeping data secure online.
While no personal information was believed to have been accessed, it follows major data breaches involving businesses including Origin Energy, Optus and Medibank in recent years, in which personal data was accessed or stolen.
"My experience dealing with different organisations — ranging from small businesses to banks — is that they struggle to find enough resources to cover [cyber security]," Lazarescu tells SBS News.
News that makes sense
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
Even if they have the funds to protect their systems, finding people with the right skills is difficult.
The reality is that if people want to get to your data [and] it is available, they'll probably find a way to do it.
Lazarescu says continuing to place data online at the same rate "makes no sense" and the system is "fundamentally broken".
"We can't protect things, and now you have this emergence of automatic agents, why do we keep going it?"
Lazarescu says consumers need to push for change.
"If there's no pushback, this is going to keep going."
Should we go back to paper records?
In recent years, there's been a trend towards putting everything online, but given the security risks, Lazarescu questions why it's necessary for businesses, especially telcos and power companies providing essential services, to store their customer data on the internet.
These businesses have millions of customers, which means a cybersecurity breach has the potential to impact significant numbers of people.
Almost 10 million people had personal information accessed in 2022 when Optus' system was hacked, and around 10,000 had their data published on the dark web.
The hack of Origin Energy in July impacted almost one million current and former customers.
The number of hacking attacks is rising, with the Office of the Australian Information Commissioner saying it received 1,205 data breach notifications in 2025, an increase of 8 per cent from the previous year.
Until a system is developed that enables information to be stored securely, Lazarescu says some businesses should consider returning to paper records, something that was functional in the past.
I've seen all kind of benefits being touted [to putting stuff online]. I haven’t seen yet any evidence that [it's] paying off.
Lazarescu points out the internet is essentially "unsecurable", arguing its underlying protocols were designed in an era when computers were primarily being used to link academics at different universities and assumed users were trustworthy.
"At the fundamental level [it] can't be secured unless we have an internet 2.0, and I can’t see anybody trying to do that," he says.
This makes putting stuff online a "comprehensively bad thing to do".
But Rahat Masood, a senior lecturer at the School of Computer Sciences and Engineering at the University of New South Wales, is sceptical about whether returning to paper records is practical.
She says technology has advanced and a significant increase in printing could also increase carbon emissions.
"The only solution I can see is public awareness and sharing less data, and companies collecting less data," Masood tells SBS News.
Rethinking data collection
While companies should be minimising the amount of personal information they hold, they often have limited incentives to delete data once it has been collected. Masood says many companies earn money from selling data.
It’s now common for businesses to ask for personal details from customers even when some of that information may not be essential to providing the service.
Masood points to Medicare card details being stolen during the recent Quest Apartment Hotels data breach.
Why do you need the Medicare [details to rent an] apartment?
The Quest hack raises questions about not only what information businesses collect, but also how long they retain it. Some impacted customers told the media they had last interacted with the business years ago.
Masood says data should only be stored when it is needed, and then deleted after a certain time period, including when a person dies.
While fines of up to $2.5 million for a person, and up to $50 million or other substantial penalties for a company, depending on the circumstances, can be issued for privacy breaches in Australia, Masood points out that laws are often not enforced.
She believes companies operating in Australia should be audited to ensure they are meeting the requirements of the Privacy Act 1988. This regulates how government agencies as well as some organisations, including those with an annual turnover of more than $3 million, handle personal information.
Changes should also be made so that people are given user-friendly and concise information about companies' privacy policies, instead of pages of terms and conditions they don't understand.
Masood says customers need simple information about what type of data is stored on business servers, how it is used, why it is needed, the potential consequences of this data storage, as well as who they can contact with issues.
"It's not a difficult task, it's just that companies don't want to do it."
More accountability needed
Jacqueline Boaks, a lecturer at Curtin University who specialises in business ethics, says there's often a sense of inevitability around AI and a sense of powerlessness that anything can be done to stop it, but she argues that societies have well-established laws to hold people morally and legally responsible for creating and releasing a product that does harm.
"We shouldn't forget that, just because something's digital and not physical," she tells SBS News.
We as a community and as the government need to have an expectation morally and ethically around who is accountable and who is responsible when [hacks] happen.
Boaks says it's impossible for individuals to oversee how their data is managed by companies or to opt out of services such as Medicare.
"[This] is a pretty vulnerable place to be, but it does seem to be exactly the kind of thing that we have a right to expect governments to protect us from," she says.
"That's one of their core roles."
But Boaks says there's often a disconnect between the level of harm done through these data leaks and the consequences faced by companies.
Lazarescu agrees the consequences are not serious enough for companies to change their practices.
What happens when you have a breach? Do you see anything in terms of people being held accountable? Organisations being held accountable?
Lazarescu, who grew up in Romania under Communist Party rule, is also sensitive to what could happen if more aspects of people's lives move into digital systems, particularly if governments can easily erase people.
"To me the biggest problem with putting stuff online is that you can also modify it online."
What can people do to protect their data?
Leaders such as United States President Donald Trump have rejected the need for stronger AI regulation, and Trump has also criticised Australia's plan for digital duty of care laws that would give residents the option to opt out of algorithmic feeds.
But Lazarescu says this doesn't mean every American agrees with the Trump administration's position.
People have a lot more power and they need to be engaged and tell the politicians enough is enough.
At an individual level, Lazarescu and Masood warn against sharing anything online unless it is absolutely necessary.
This includes posting on social media, which can allow companies to build detailed profiles of users, avoiding unnecessary sharing of documents such as passport copies, and not entering sensitive details into AI programs such as OpenAI's ChatGPT and other large language models.
"It's very crucial now," Masood says. "You need to be minimising the data yourself."
For the latest from SBS News, download our app and subscribe to our newsletter.
