MyGov Accounts Locked as Credential-Stuffing Attacks Surge on August 19

Thousands of Australians have had their myGov accounts temporarily locked after Services Australia detected suspicious sign-in attempts using stolen credentials from unrelated data breaches. Services Australia General Manager Hank Jongen confirmed the platform has not been hacked and the lockouts are automated safeguards working as designed. Affected users must follow official recovery instructions sent via email to regain access.

Why accounts are being locked

Bad actors are running credential-stuffing attacks, using email addresses and password combinations stolen from other companies’ data breaches to force their way into myGov accounts. When myGov detects multiple failed login attempts, it automatically locks the account or disables sign-in options like email and mobile number usernames. This is standard practice for major digital platforms under attack.

What users are seeing in lockout notifications

Affected Australians receive emails or texts stating: “Your sign in details have been entered incorrectly too many times. Your account is temporarily locked.” The notification explains that while locked, users cannot sign in with Digital ID or passkey, and email or mobile number usernames have been turned off. Services Australia confirmed this is not a breach but a protective measure.

How to unlock your account safely

The only way to reactivate access is to follow recovery instructions provided directly by Services Australia via email. Users must sign in with their unique myGov username and current password instead of email or mobile number. Services Australia advises never to click links in suspicious messages claiming to unlock accounts. Access myGov only through the official website or app.

Strengthening your account against future attacks

Services Australia recommends using passkeys or Digital ID for stronger protection than passwords alone. Passkeys use biometric or device-based authentication, making them harder for scammers to compromise. Users should also check that old passkeys have been deleted from password managers and ensure their devices are updated with the latest software.

Final Thoughts

MyGov lockouts are a security feature, not a failure. Australians who receive account notifications should verify they are genuine by accessing myGov directly, never through email links. Using passkeys or Digital ID significantly reduces the risk of future lockouts.

FAQs

Disclaimer:

The content shared by Meyka AI PTY LTD is solely for research and informational purposes.  Meyka is not a financial advisory service, and the information provided should not be considered investment or trading advice.