Greater Dandenong Council has resumed services from call-centre operator Oracle CMS, despite a cyber-security data breach last year.
Oracle CMS, which provides an after-hours call answering service for the council, had been hacked by ransomware cybercriminal group LockBit in April 2024.
After a ransom demand, the hackers published documents relating to Oracle’s clients, including Greater Dandenong Council.
Greater Dandenong chief executive Jacqui Weatherill said the data breach related to Oracle CMS’s own systems, resulting in the release of details from calls in 2010, 2016 and a period during 2020-‘21.
“The data released was limited to what was provided during the call.
“In most cases this was a name and phone number, or name and reason for the call, such as reporting a ‘fallen tree’ or ‘dead animal on the road’.
“We did not identify any sensitive or health related information that had been disclosed.”
The matter was “thoroughly investigated”, and the council’s own systems and databases weren’t accessed, she said.
“(Oracle) had been storing limited amounts of data in relation to its services to clients in a local drive.
“Numerous councils and organisations across Australia had data affected by the breach.”
In response, the council had immediately suspended part of the Oracle CMS service, Weatherill said.
“(We) brought it in-house until we were confident that all risks had been adequately mitigated.
“We have since returned to Oracle CMS providing its usual after-hour call service.
“We are satisfied that Oracle CMS took all recommended actions to improve data protections.”
The council will be considering the contract later this year as part of a “regular review”, Weatherill said.
In a separate matter, Greater Dandenong recently dumped its contract with a different organisation Oracle Service Cloud CRM.
“It was no longer delivering value for money,” Weatherill said.
