Papua New Guinea’s tax office has been hit with a major cyber attack, pushing systems offline and potentially exposing sensitive data belonging to hundreds of thousands of people and businesses, including Australian companies and citizens. On 29 January, the Internal Revenue Commission (IRC) — PNG’s version of the ATO — notified the public of a “system outage” affecting its network. It said a team was working to resolve the issue, however many of the IRC’s functions remain offline two weeks later. Sources in PNG and Australia have confirmed the issues were the result of a cyber attack. The IRC has not yet notified the public of the cyber attack and IRC Commissioner General Sam Koim did not respond to the ABC’s detailed questions. The ABC understands impacts of the hack extend to the IRC’s core tax system, SIGTAS, and network, including phone and email communications. A local tax agent, who did not wish to be identified, said the attack was extremely concerning and had impacted clients and businesses. “A lot of clients are not getting approvals and clearances, which is slowing down their business operations,” the tax agent said. The tax agent added the IRC clearly needed assistance from outside the organisation to deal to with the fallout. The Australian government has a dedicated cyber security team that can respond to cyber crises in the Pacific region. The ABC understands Australia has offered support to PNG in the wake of the IRC hack, but the assistance has not been taken up at this stage. Mihai Sora, director of the Pacific Islands Programme at the Lowy Institute, said that was surprising. “Cyber security has been flagged as a priority by Pacific islands senior officials and decision makers,” Sora said. “I would have thought that, unless the IRC has its own crack squad of systems engineers at the ready, that they would have been happy to receive a rapid response team from Australia.” The ABC understands the IRC has engaged a private company to assist with the recovery. Robert Potter, a cyber security expert who helped set up PNG’s National Cyber Security Centre, said the recovery process could expose the IRC to greater scrutiny. “It’s always a sensitive time when external partners come in to help … there’s always a huge concern on the Papua New Guinea side about what other embarrassing things might be seen or released as a result of these sorts of attacks.” He said it could take weeks or even months for the IRC system to be fully restored. “They don’t have the same budgets for IT that Western countries like Australia have, and so when they get attacked, the impacts are usually greater, and the damage usually lasts for longer,” he said. “I think it’s a bit of a dog act for hackers to go after developing economies, they’re obviously more open and vulnerable.” It’s unclear exactly who is behind the hack, how much sensitive information has been leaked and whether it can be recovered. Sora said it could impact trust, particularly among foreign investors. “It can be difficult for the private sector to operationalise their potential interest in PNG and these sorts of attacks, that’s just another reason to hesitate for them,” he told the ABC. The Pacific region has been a target of an increasing number of cyber hacks in recent years. This week, the government of Samoa issued and advisory, blaming Chinese state-backed hacking group APT40 China blamed for cyber attacks on Samoa. “Unfortunately, it’s one of the side-effects of an increasingly digital Pacific and increasingly connected region,” Sora said. “What we know broadly across the region is that cyber security measures haven’t kept up with that pace of rapid digitisation. It sounds very, very unfortunate, but it’s not surprising.” In 2021, PNG’s Department of Finance was struck with a ransomware attack, with hackers demanding a Bitcoin ransom payment in exchange for data.