The PNG tax office, Papua New Guinea’s Internal Revenue Commission (IRC), suffered a significant cyberattack in late January 2025. This PNG tax office cyber attack resulted in a “system outage,” according to an announcement on January 29th.
ABC News reported this outage was, in fact, a major cyberattack. The attack targeted the IRC’s Standard Integrated Tax Accounting System (SIGTAS), along with its internet networks, phone systems, and email communications.
The nature and extent of the data breach remain unclear. However, there are concerns that sensitive information belonging to Australian companies and individuals may have been compromised. Papua New Guinea citizens have yet to receive official notification regarding the incident. The identity of the perpetrators is also unknown.
Several core IRC functions have been offline for weeks following the PNG tax office cyber attack. The IRC has reportedly engaged a private company to assist with recovery efforts.
Australia has offered cybersecurity expertise to support the PNG government’s response, though it’s unclear if this offer has been accepted. The Department of Foreign Affairs and Trade (DFAT) and the office of PNG’s Minister for Information and Communication Technology, Timothy Masiu, have been contacted for comment, but have yet to respond.
Cybersecurity PNG Limited, a local firm, commented on the increasing frequency of cyberattacks targeting government agencies.
They stated, “As PNG accelerates digital transformation, the urgency to fortify cybersecurity defences has never been greater.”
This incident follows a ransomware attack on PNG’s Department of Finance in October 2021. In October 2024, Minister Masiu acknowledged improvements in PNG’s cybersecurity posture but also highlighted the need for further advancements in its ICT systems.
He stated, “while PNG had ‘made significant improvement’ in its cybersecurity posture in recent years, the nation realised ‘there is still so much to do’ to improve its ICT systems.”
The PNG National Cyber Security Centre, a joint Australian and PNG government initiative launched in 2018, is tasked with addressing these challenges. The PNG tax office cyber attack underscores the ongoing need for improved cybersecurity infrastructure and response capabilities within Papua New Guinea.
