Queensland cyber security department lost over $800,000 in July 2025 cyber attack

The Queensland government department delivering the state's first cyber security strategy lost more than $800,000 in a cyber attack, a new report has revealed.

The Customer Services, Open Data and Small and Family Business department plays a lead role in strengthening the state government's cyber security capabilities.

In the department's latest annual report, the entity noted it lost $809,000 in public money as a result of an external cyber attack in July 2025.

A department spokesperson said no payment was made "to those responsible".

"Immediate steps were taken to contain and investigate the incident, and security controls have been further strengthened."

The review, released on Friday, said no government data or sensitive information was compromised during the incident.

"The department blocked the attack and engaged a third party to mitigate any further exposure," the report said.

The entity is responsible for setting the cyber security policy and guidance for the state's public sector and for managing whole-of-government cyber security services.

"The Queensland government is committed to protecting the security and resilience of its systems and services," the spokesperson said.

Thousands of cyber security events

In the Transport and Main Roads Department's annual report, the entity said it reviewed more than 9,000 suspicious activities in the last financial year.

The department also investigated more than 3,000 cyber security events.

"These efforts supported early threat detection, reduced operational impacts and informed ongoing improvements to security controls," the report said.

A transport department spokesperson said the entity continues to enhance its cyber security capability through continuous monitoring, staff awareness programs, security assurance activities, and targeted initiatives aligned with the state's cyber security strategy.

It said the department actively monitors and investigates suspicious activities to protect the state's transport services, information systems, and customer data.

Under legislative requirements, the department notifies individuals when an incident results in an eligible privacy breach.

In March, the Queensland Audit Office published a report that examined and tested the effectiveness of a state government, local government, and statutory body's IT security controls.

The audit gained the "highest level of access" to two government entities in the state.

It did not name the entities "to avoid publicly identifying any security vulnerabilities".

The report found that the increasing frequency and sophistication of cyber attacks could expose entities that had weak cybersecurity.

It recommended all public sector entities and local governments review and, where needed, update their policies to ensure there is appropriate guidance about identifying, assessing, and monitoring third-party cyber security risks and developing mitigation controls.

In the Customer Services department's "cyber security leadership role", it agreed to all relevant recommendations and progressed actions, including initiatives to strengthen whole‑of‑government cyber security capability.