Medicare hack alert went to inbox checked once a day and took five days to be escalated

Government ministers have shared new details about the timeline of a Medicare breach by an OpenAI agent, revealing that OpenAI's notification of the hack was sent to an inbox checked once a day.

Defence Minister Richard Marles and Government Services Minister Katy Gallagher fronted reporters on Thursday after Prime Minister Anthony Albanese revealed an agent linked to the developer of the popular chatbot ChatGPT gained unauthorised access to the public–facing Medicare Statistics Reporting Service Portal, administered by Services Australia.

OpenAI said on Thursday that no personal information was accessed during the breach, with the federal government also playing down concerns while stressing the incident was unacceptable — establishing a taskforce to investigate the breach and not ruling out penalties against the tech giant.

Earlier on Thursday morning, it was revealed the incident occurred on 18 June, but the government was not made aware of it until 10 September when OpenAI sent an email to a Services Australia inbox that Gallagher said was typically used by researchers to alert the government agency to possible vulnerabilities in its systems.

The inbox is only checked once a day, Gallagher said, and Services Australia found the email the next day. By 15 September, the government agency had determined the email was legitimate and escalated the incident to the Australian Signals Directorate.

The government services minister said she was notified on 17 September and then spoke with Marles, Services Australia, and the Australian Signals Directorate.

'Forensic investigation' underway

Gallagher said there had been "quite a lot of work over that weekend to try and get to the bottom of what had happened here".

Asked if the inbox the initial email went to should be more actively monitored, Gallagher said that would form part of the "forensic investigation" into the incident.

Marles said the government had told OpenAI it was unhappy with how the AI juggernaut had handled the incident, and that he had not been notified of it when he met CEO Sam Altman earlier this month.

"What we would expect is that the government be notified in the most timely manner possible, and we have expressed our displeasure that that did not occur in this instance," Marles told reporters.

The government informed the public as soon as it could, Marles said, adding the incident appeared to be "relatively minor" but still "very serious", and unknowns remained.

"We really wanted to firstly assure ourselves that the impact of the specific incident was, as I have said, relatively minor, and we do want to be able to reassure Australians about that," Marles said.

"But the incident itself is obviously very serious. It's very serious that we've got an AI agent having gained unauthorised access into an Australian website."

Agent was 'conducting research into public medicine spending'

Gallagher said the government had a "technical interaction" with OpenAI on Tuesday that had provided a "level of comfort about what the agent had been doing".

She said it had been "undertaking a task by OpenAI to conduct internet–based research into public medicine spending as part of internal capability evaluation".

The Medicare Statistics Reporting Portal is a public–facing portal that contains non–sensitive Medicare information relating to data and statistics, such as spending, Gallagher said, describing it as a "legacy system".

"It's not a system of government significance, so it doesn't have the cyber protections that you would expect on that personally held information, but it did have protections in place. Unfortunately, this agent got around that."

The government has stressed that systems containing national security information are protected by far higher levels of security.

Victoria and NSW respond

Three other systems are also believed to have been affected: the Australian Institute of Health and Welfare, the NSW Bureau of Statistics and Research, and the Victorian Department of Health.

Victorian Premier Ben Carroll and NSW Premier Chris Minns both said they had spoken with Albanese and understood there had been no breach of personal information contained in systems in their jurisdictions caught up in the hack.

Minns said NSW will "be working with Commonwealth intelligence agencies to get to the bottom of it", while Carroll said he would have more to say in due course.

The task force will be led by the Department of the Prime Minister and Cabinet and also involve the Australian Signals Directorate, the AI Safety Institute, the Office of AI, and other government agencies.

Albanese says incident 'unacceptable'

The revelations came as AI bosses for OpenAI and Anthropic, who have recently called for a slowdown in development, told the United Nations Security Council of the risks posed by runaway AI.

OpenAI said the information in the breach amounted to aggregate health statistics and file names.

"Our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation. In the course of that, our models took actions we did not intend," an OpenAI spokesperson said in a statement.

Albanese, who is currently in New York for the United Nations General Assembly, said he had a phone conversation with OpenAI's Altman in which he expressed "Australia's extreme concern about this incident".

"I also expressed my disappointment that it took the company way too long to inform the government what had occurred, and the nature of the way that notification occurred as well was unacceptable," Albanese told reporters.

He said Altman had "clearly accepted" the company had not done enough on the issue.

The government has said it is examining the "legal situation" around the breach, with the possibility of penalties for OpenAI remaining on the table.

Albanese was recently among more than 20 signatories to a joint statement calling for greater restraints on AI.

United States President Donald Trump has urged accelerating AI, calling fears about it a "hoax".

The statement said while the technology had many potential benefits, such as those in medical research, the downsides remained a significant concern.

For the latest from SBS News, download our app and subscribe to our newsletter.