The Australian Taxation Office’s services are increasingly moving online, and while this is convenient for millions of Australians, it also puts them at risk of having personal data compromised.

Second Commissioner Jeremy Hirschhorn revealed that the ATO is hit by three million attempted cyber-attacks a month, warning of “cascading penetration attempts” when criminals steal information from different databases before using it together to bypass ID measures.

At a speech during the Tax Summit 2022, currently taking place in Sydney at the ICC, Hirschorn says the recent hacks “brought home how vulnerable many businesses and organisations are to attack”.

“The flip side of digitisation is cybersecurity,” he said.

“There is [the possibility] of cyber-enabled identity fraud and cyber-enabled information theft. In the time it takes me to make this speech, there will be 4,000 attempted hacks on the ATO’s system. There are three million attempted hacks of the ATO’s system every month.

“The systems of tax agents and super funds are also a ripe source of data. Increasingly, we see cascading penetration attempts, where criminals attempt to obtain information from different devices before putting it together for a fraud attempt.

“The Optus data breach has really brought home how vulnerable many businesses and organisations are to attack and dispelled any sense of hubris. That’s a topic on its own but the ATO will continue to strengthen our safeguards and think about how we can help the broader ecosystem that you [tax agents] are part of.”