Australian PM says OpenAI took too long to disclose health department website breach

Australian Prime Minister Anthony Albanese has said he is "extremely concerned" about a breach of an Australian health department website attributed to OpenAI, criticising the artificial intelligence company for taking too long to disclose the incident, according to NPR.

The breach involved an Australian health department website, though the full scope of what data may have been accessed or exposed was not detailed in the available report. Albanese's comments signal a strained response from the Australian government toward OpenAI over both the security lapse itself and the company's handling of disclosure afterward.

Delay in disclosure draws criticism

Central to Albanese's criticism is the timing of OpenAI's disclosure: the prime minister suggested the company took too long to reveal that the breach had occurred, a common source of tension between governments and technology companies after cybersecurity incidents. Delayed disclosure can complicate efforts by affected agencies to notify individuals, secure systems, and assess potential harm.

It was not specified in the original report exactly how long OpenAI waited before informing Australian authorities, nor what specific health department systems or data were involved.

Cybersecurity incidents involving government health data typically trigger regulatory review and, in some jurisdictions, mandatory reporting obligations for the parties involved. It remains to be seen whether Australian regulators will pursue a formal inquiry into the circumstances of the breach or OpenAI's compliance with local disclosure requirements.

Broader scrutiny of AI companies

The incident adds to a broader pattern of scrutiny facing AI companies over how they handle sensitive data and respond to security incidents, particularly when government systems and citizens' health information are involved. Governments around the world have increasingly pressed technology firms, including AI developers, for faster and more transparent breach reporting.

OpenAI has not been quoted directly in the available report responding to Albanese's remarks. Further details on the nature of the breach, its cause, and any remedial steps being taken were not included in the original account.