The Australian Cyber Security Centre warned on Monday that Fortinet SSL VPN appliances sitting on shire council networks remain exposed after automated scans found hundreds of Australian gateways advertising outdated firmware on the public internet.
What ACSC saw
Telemetry from partner honeypots flagged spikes in credential-stuffing attempts against council-hosted VPN portals, many still running builds missing patches released earlier in the year. ACSC’s alert tells IT teams to upgrade immediately, enforce multi-factor authentication on every remote-access account and remove interfaces from direct internet exposure where possible.
Regional councils often share IT staff across multiple LGAs, stretching patch windows. Some shires still route planning approvals through VPN tunnels because legacy on-premise servers never migrated to cloud hosting, multiplying the attack surface ACSC is worried about. The centre offered incident response hotline slots for councils that discover active intrusions rather than mere exposure.
Why councils are targeted
Local government holds rates databases, building approvals and payroll for essential workers. Ransomware crews treat councils as soft targets with insurance-backed payouts. VPN appliances are favourite entry points because staff expect always-on remote access after pandemic hybrid work became permanent.
Essential Eight maturity assessments show councils lag state agencies on application control and macro settings, compounding VPN risk.
Mitigation steps
ACSC recommends split DNS, geo-blocking non-Australian login attempts where feasible, and logging to the statewide cyber threat sharing platform. Fortinet’s vendor guidance lists specific build numbers; IT managers should verify configuration backups before rebooting production clusters serving planning portals.
Ratepayers may see brief outages while patches roll. Councillors were told not to bypass IT with consumer remote-desktop tools—a pattern observed after previous alerts when staff chased convenience.
Funding pressure
Federal cyber grants for local government remain competitive. Shires without dedicated security engineers may outsource monitoring to managed service providers, but contracts must spell out patch SLAs. Monday’s alert is a reminder that perimeter appliances need the same discipline as state data centres, even when budgets are a fraction of the size.
Vendor response
Fortinet published builds overnight matching ACSC guidance, with automated firmware downloads disabled by default so councils can stage upgrades. State governments offered shared procurement panels to cut licence renewal costs for smaller councils buying security appliances on thin budgets. Insurance underwriters reviewing council cyber policies signalled they will ask for proof of VPN patching before the next renewal window.
Incident patterns
ACSC case notes from the past quarter show attackers pairing VPN exploits with stolen session cookies taken from compromised staff laptops. Once inside, crews mapped file shares holding ratepayer databases and, in two instances, staged ransomware payloads that were caught before detonation. Both councils had backups offline, but recovery still took days because planning portals shared hardware with finance VLANs that were not segmented.
Citizen impact
Residents applying for development approvals online may see maintenance banners during overnight upgrade windows. Councils urged patience and warned against phishing texts claiming refunds for delayed applications. Genuine outage notices will be posted only on official council domains, not via SMS links.
Coordination with states
Queensland and Victoria offered shared security operations centre shifts to neighbouring shires that lack after-hours staff. Western Australia’s government cyber unit ran a bridge call Monday afternoon for IT managers patching Fortinet clusters before cyclone season logistics demand attention. The cooperative model may become permanent if federal grants expand in the next budget.
Municipal associations reminded elected officials that cyber resilience is now a ratepayer issue: insurance premiums for councils rose last renewal cycle after two regional ransomware events. Patch compliance may influence whether underwriters extend coverage without steep excess hikes.
ACSC will publish an anonymised scorecard next month ranking council VPN hygiene without naming laggards publicly, giving state auditors a benchmark ahead of grant applications and helping mayors justify security spend in budget papers voters actually read each year.