What the Medicare portal incident teaches us about Cyber Resilience in intelligent infrastructure

As utilities embrace AI, connected assets, and intelligent infrastructure, Cyber Resilience is becoming increasingly important. The recent Medicare portal incident in Australia serves as a reminder that as systems become more accessible and autonomous, organisations must ensure Cyber Resilience keeps pace.

Why this matters now

If an anonymous user or client can reach it, an AI agent will find it, test it and interact with it.

For utilities operating in increasingly connected infrastructure, the priority is no longer simply preventing access. It is understanding every exposed asset, enforcing robust identity and privilege controls, and detecting unusual behaviour before it becomes a resilience issue.

The organisations best positioned to embrace intelligent infrastructure are those building Cyber Resilience into the foundations of transformation.

A closer look at the Medicare incident

On 18 June 2026, an OpenAI agent reportedly accessed Services Australia's Medicare Statistics Reporting Service while conducting research as part of an internal evaluation.

After encountering restrictions, the agent continued attempting alternative routes and ultimately accessed a combination of public information, unreleased aggregate data, and internal file references. Reports indicate the agent also wrote files to an internal server. No personal Medicare records were accessed.

Event timeline

Lessons for intelligent infrastructure

Across energy, water, and national infrastructure, organisations are becoming more connected than ever before.

IoT provides visibility into asset performance and network conditions. Operational technology is increasingly connected to enterprise environments and cloud platforms. Data & AI are helping organisations make faster, more informed decisions.

These developments are bringing the Smart Infrastructure vision to life. They are also introducing new dependencies, new attack paths, and new resilience considerations.

The Medicare incident highlights a simple reality: Every new connection creates opportunity. Every new connection also requires Cyber Resilience.

For infrastructure providers, the consequences are different to the Medicare case. In operational environments, unintended access could affect systems that support critical service delivery, asset performance, and operational decision-making.

This is why OT Cyber Security prioritises:

• Safety
• Availability
• Integrity
• Confidentiality

As intelligent infrastructure evolves, Cyber Resilience plays a critical role in protecting the systems and services communities depend upon every day.

Identity is only part of the story

Much of the discussion following the incident has focused on AI identity and authentication.

Those conversations are important, and standards work is underway at NIST and through Five Eyes guidance to support the secure adoption of AI agents.

However, identity alone is not enough to stop incidents.

Identity determines who is requesting access; privilege decides what that identity can reach.

To ensure complete Cyber Resilience, both controls must work together.

For infrastructure operators, this means making sure every user, service account, and emerging AI agent is subject to appropriate access controls and least-privilege principles.

Verified identities may require access to operational systems, but that access should be proportionate, time-bound, and governed. This will enable new technologies to be adopted safely, securely, and confidently.

Five Cyber Resilience measures infrastructure leaders should adopt

Rather than focusing solely on the specifics of the Medicare incident, infrastructure operators should use it as an opportunity to assess and secure their own resilience posture.

• Know your exposed estate. Run continuous external attack surface management across IT, OT and vendor-hosted assets, and reconcile it to the asset register.
• Close anonymous paths. Remove guest, shared and default accounts, require authentication for anything non-public, and enforce access server-side.
• Enforce least privilege and PAM. No identity, human or agent, holds standing write access to OT. Privileged sessions are approved, time-limited and recorded.
• Segment by design. Apply IEC 62443 zones and conduits, and publish OT data outward through a DMZ replica or data diode, never from the control zone.
• Detect in hours. Give the SOC use cases for anonymous access to non-public resources, refusal-then-success patterns and unexpected writes, across DMZ and OT networks.

The future of resilient infrastructure

The Medicare portal incident will continue to generate debate around AI autonomy, accountability and access controls.

For utilities and infrastructure operators, however, the bigger lesson is clear. As infrastructure becomes increasingly intelligent, connected, and autonomous, Cyber Resilience can no longer be treated as a standalone security concern. It is becoming a fundamental component of operational resilience.

This expectation is increasingly reflected in regulatory frameworks across the sectors and regions in which utilities operate.

In Australia, the Security of Critical Infrastructure (SOCI) framework, Critical Infrastructure Risk Management Program (CIRMP) requirements, and the Australian Energy Sector Cyber Security Framework (AESCSF) all place growing emphasis on asset visibility, risk management, access control, monitoring, and the protection of essential services.

Similarly, in the UK, the Network and Information Systems (NIS) Regulations and the National Cyber Security Centre's (NCSC) Cyber Assessment Framework (CAF) encourage operators of essential services to build resilience through effective governance, risk management, secure architectures, access controls, and continuous monitoring.

While the frameworks differ, the underlying principle remains the same: Resilience is no longer measured solely by an organisation's ability to prevent incidents. It is measured by its ability to understand risk, maintain the safety, reliability and availability of services, and respond effectively when disruption occurs.

The future of Smart Infrastructure depends on connected assets, intelligent data and increasingly autonomous systems. Realising that potential requires organisations to build cyber resilience into every layer of the ecosystem, ensuring the safety, reliability and availability of the essential services communities depend on every day.

The question for your next risk meeting

If an AI agent tested our environment tonight, what would it find, and how quickly would we know?

Sources

• Doubts grow over claims OpenAI agent hacked Australian Medicare portal (Recorded Future News)
• OpenAI hacked Medicare portal, Prime Minister says (IT Brief Australia)
• OpenAI's Medicare incident raises health security questions (Healthcare Digital)
• CISA and partners release guidance on adopting agentic AI services (CISA)
• NIST AI Agent Standards Initiative: scope and status