Australia’s Medicare breach puts legacy systems under review

The incident exposed a backlog

The agent was looking for government spending data on skin-disease treatment in Victoria. OpenAI apologised to Australia, and the incident became a trigger for a nationwide review.

Finance Minister Katy Gallagher asked her department whether some of the 160 million Australian dollars allocated for cyber upgrades in the latest budget could be released sooner. Last month, she had described the Services Australia statistics portal as a legacy system.

The federal government is not starting from zero on the issue:

Gartner, in a note to clients after the portal incident, argued that technical debt—not an AI agent running out of control—is the main threat posed by legacy systems. The firm expects AI agents to interact more often with government resources and says agencies should urgently fund work based on AI-related risks. It no longer considers underfunding acceptable.

Old does not automatically mean unsafe

Salil Kanhere, a cybersecurity and AI specialist at the University of New South Wales, cautioned against using a system’s age alone to decide whether it should be replaced. A 15-year-old system with proper support, security updates and isolation can be less risky than a newer system that is poorly maintained.

But old systems often have known vulnerabilities, and AI agents that persistently search for weaknesses may find them faster. Ian Xiang, a professor in Monash University’s Department of Software Systems and Cybersecurity, called the federal review necessary and urgent. He said agents can speed up attacks, lower their cost and make it easier to target multiple systems at scale.

The state audits show how broad the backlog can be:

South Australia has allocated 325.6 million Australian dollars over its last three budgets, including funding to address outdated technology. In Queensland, the 2025 budget set aside 1 billion Australian dollars for IT investment over four years, including replacement or upgrades of legacy systems.

The costs are not only technical. In South Australia, frontline staff spend time working around system limitations and keeping records, leaving them less time to support vulnerable children and families.

Rogue AI hacks government system for first time - The Latest

Source: theguardian.com

The expensive part is choosing what to fix

Xiang says agencies should identify which systems need replacement first. Kanhere also recommends starting with the highest-risk systems, then building protective boundaries around the rest. The Australian Cyber Security Centre’s recent guidance calls replacement the most effective way to reduce the risks from old systems. When replacement is not possible, agencies should consider separating or isolating a system from the wider network.

I think the Medicare incident makes the case for urgency, but not for replacing every old system at once. The harder task is deciding which systems are genuinely dangerous, which can be secured, and how to fund that distinction. A rushed replacement programme could be costly; leaving known weaknesses in place carries its own price.

The public figures point to constraints as well as need: agencies cite both insufficient targeted funding and a lack of suitable replacements. The federal review can make the backlog visible. It cannot, by itself, make the hard choices about what gets fixed first.