Proactive Security Measures
Services Australia has initiated a series of automated security lockouts across the myGov portal in response to a surge in credential-stuffing attacks. These incidents involve malicious actors using email addresses and password combinations stolen from external, non-government data breaches to attempt unauthorized access to Australian government services.
General Manager of Services Australia, Hank Jongen, confirmed that the platform has not been hacked and remains secure. The lockouts are a precautionary, automated response designed to protect individual accounts. Users affected by these measures received notifications stating their accounts were “temporarily locked” due to repeated incorrect sign-in attempts.
This report draws on information published by news.ssbcrack.com and nine.com.au.
Impact on Access and Sign-in Protocols
The security measures have introduced significant changes to how users access their accounts. Services Australia has disabled the option to sign in using email addresses or mobile numbers as usernames for affected accounts. Furthermore, while an account is locked, users are unable to access the portal via Digital ID or passkeys, necessitating a specific recovery process.
Affected individuals must follow the instructions provided by Services Australia via email to restore access. Officials are warning users to be vigilant against phishing attempts during this period. Services Australia explicitly stated that it will never send emails or text messages containing direct links for users to click to sign in.
Strengthening Digital Defenses
Once access is restored, the agency is urging users to perform a security review. This process encourages the transition to more robust authentication methods, specifically Digital ID and passkeys. While users may technically re-enable email or mobile number sign-in options, the agency advises against this if those credentials have been compromised in past data breaches.
To ensure safety, users should only access the portal by typing my.gov.au directly into their browser or by using the official myGov mobile application. These steps are critical in mitigating the risks posed by scammers who exploit reused passwords from third-party platforms to gain entry to government services.