When Noosa Shire Council finally broke the news to residents on social media this week, the reaction was swift and furious.
Comments flooded in faster than the council could handle, forcing moderators to deactivate discussion within an hour.
The reason for the outrage? Their beloved beachside council had been duped out of $2.3 million by international criminals in December 2024—and they’d kept quiet about it for nearly ten months.
The revelation has sent shockwaves through the Sunshine Coast community, with many questioning how such a sophisticated scam could have succeeded and whether their rates will rise to cover the massive loss.
The anatomy of a modern AI scam
Noosa Council chief executive Larry Sengstock described the December 2024 incident as a 'major fraud' involving 'sophisticated social engineering AI techniques' —the latest evolution in a growing wave of scams targeting government organisations.
According to Sengstock, the fraud was 'not related to cybersecurity.' No systems were breached, no data was stolen, and there was “no impact to the public or our services.”
Social engineering has long relied on manipulating people rather than hacking computers, but artificial intelligence has made these attacks almost impossibly convincing. Criminals can now replicate voices, write flawless corporate emails, or generate entirely fake phone conversations—exploiting human trust instead of breaking digital defences.
Sengstock emphasised that no council staff were at fault or involved in the criminal activity, saying the offenders had exploited process vulnerabilities rather than IT weaknesses.
'Unfortunately, as we are seeing every day in the media, scams and frauds are on the rise, and many companies and organisations are being targeted,' he said.
A costly Christmas surprise
The fraud occurred in December 2024, during the Christmas period when many staff were on holidays and normal verification procedures may have been relaxed.
The council initially lost $2.3 million but managed to recover about $440,000 through banks and authorities, leaving a total shortfall of roughly $1.9 million. The case is now being investigated by the Australian Federal Police and Interpol.
What makes this episode particularly galling for residents is the delay in disclosure. Police had instructed the council not to make the incident public at first, but the council never explained why it waited until October 2025 to share the news.
'Council takes its financial responsibility very seriously and, on behalf of management, I am sorry that this has happened,' Sengstock said, adding that several recommendations from the Queensland Audit Office had since been implemented to improve internal processes.
Ratepayers fear the bill
The community reaction was immediate. 'Bracing ourselves for further rate increases,' one resident wrote on Facebook, while another demanded: 'We need answers—this is our rates money!'
Others questioned how services could remain unaffected after such a huge financial loss. The council eventually turned off comments, stating it was to “ensure the focus remains on the accuracy of information shared.”
Their frustration isn’t unfounded. Ratepayers had already endured nearly a seven per cent rise earlier this year to fund the latest budget, and many fear they’ll be asked to pay again to make up the shortfall.
Despite having 'processes and procedures to mitigate this type of event,' the council fell victim to a highly strategic criminal operation that bypassed traditional checks.
Sengstock said the experience 'serves as a warning to other councils and local businesses to be on their guard and continually review processes around all financial procedures.'
What is social engineering AI?
Social engineering AI combines psychological manipulation with artificial intelligence to create extremely convincing scams.
Criminals might use AI to clone voices, generate realistic emails, or create deepfake videos to trick employees into transferring money or revealing sensitive information.
These attacks target human judgment rather than computer systems — making awareness and training critical.
The broader threat landscape
The Noosa Council fraud coincides with growing concern over cybercrime across Australian institutions. Councils are increasingly targeted because they handle large budgets and public data but often lack enterprise-level security resources.
The Australian Signals Directorate defines social engineering as incidents in which malicious actors trick individuals into performing actions like opening attachments, revealing credentials, or transferring funds—all tactics criminals likely used in this case.
Cyber safety expert and former Victoria Police officer Susan McLean said the breach likely involved human error. 'I would guess human error where an employee allowed someone into a system or transferred money without triple checking,' she told Daily Mail Australia, while noting that limited public details made it difficult to be sure.
The situation mirrors other recent attacks on local governments, such as the December 2024 ransomware strike on Muswellbrook Shire Council, which was attributed to the SafePay group. Experts say these incidents underline the need for stronger financial controls and multi-layered verification procedures across councils nationwide.
Protecting your community
While individual residents can’t control council systems, transparency and community awareness are powerful tools. Councils are custodians of public funds, and greater scrutiny helps deter negligence and misconduct.
Ratepayers can play a role by staying informed, attending meetings, and demanding regular financial reporting and updates on cybersecurity preparedness.
Sengstock said that once the fraud was detected, 'we established our incident crisis response team and immediately reviewed our operating procedures to ensure that processes were improved and any risk of future fraud was minimised.'
A council spokesperson later confirmed: 'We are not going to disclose specific details of how the incident occurred. This is a matter for Queensland Police, and the investigation is ongoing.'
Protecting your community from AI scams
- AI-driven scams target human behaviour, not just computer systems.
- Criminals increasingly impersonate officials or vendors using cloned voices and realistic correspondence.
- Strong internal controls and dual authorisation processes reduce risk.
- Transparency and independent audits help rebuild public trust after incidents.
- Public awareness campaigns can help communities identify and report fraud attempts early.
Questions that demand answers
As investigations continue, residents want to know exactly how the scammers convinced staff to transfer millions and what new safeguards will prevent a repeat. With $1.9 million of public money still missing, accountability remains a pressing issue for a community that prides itself on trust and transparency.
The Noosa incident is a stark warning of how modern scams exploit not just technology but human trust. As AI tools make deception ever more convincing, protecting our institutions will require more than firewalls—it will demand vigilance, transparency, and shared responsibility between leaders and the communities they serve.
What This Means For You
The story of Noosa’s costly Christmas scam is more than a tale of one council’s misfortune. It’s a national wake-up call about how vulnerable even well-run organisations can be in the era of AI-enhanced fraud. As Sengstock put it, the challenge now is to learn from the experience, strengthen systems, and ensure the same thing can never happen again.
What lessons should local governments draw from Noosa’s experience? Have you seen changes in how your council communicates about financial integrity and cybersecurity? Share your thoughts in the comments below.
Primary Source
https://www.dailymail.co.uk/news/article-15189429/Noosa-Council-fraud-Queensland.html
Noosa Council reveals social engineering attack that cost council millions—Cyber Daily
Cited text: “During the 2024 Christmas period Noosa Council was the victim of a major fraud incident, perpetrated by international criminal gangs currently under ...
Excerpt: Their beloved beachside council had been duped out of $2.3 million by international criminals during the 2024 Christmas period
https://www.cyberdaily.au/security/...engineering-attack-that-cost-council-millions
AI scam defrauds Noosa Council of $1.9m | Information Age | ACS
Cited text: “However, we can reveal that the fraudulent activity was sophisticated, strategic, and targeted.” · Scammers targeted the south-east Queensland counci...
Excerpt: Their beloved beachside council had been duped out of $2.3 million by international criminals during the 2024 Christmas period
https://ia.acs.org.au/article/2025/ai-scam-defrauds-noosa-council-of--1-9m.html
AI scam defrauds Noosa Council of $1.9m | Information Age | ACS
Cited text: In what Noosa Council chief executive Larry Sengstock described as a “major fraud incident” the scammers used “sophisticated social engineering AI tec...
Excerpt: What Noosa Council chief executive Larry Sengstock described as 'sophisticated social engineering AI techniques'
https://ia.acs.org.au/article/2025/ai-scam-defrauds-noosa-council-of--1-9m.html
AI scam defrauds Noosa Council of $1.9m | Information Age | ACS
Cited text: Despite the incident involving social engineering—a highly popular cybercriminal method—Sengstock emphasised the fraud was “not related to cyberse...
Excerpt: This fraud was not related to cybersecurity. Council systems were not breached or affected, no data was stolen and there was no impact to the public or our services
https://ia.acs.org.au/article/2025/ai-scam-defrauds-noosa-council-of--1-9m.html
AI scam defrauds Noosa Council of $1.9m | Information Age | ACS
Cited text: The council has been able to recoup approximately $400,000 of that by working with banks and authorities, according to the ABC, though Sengstock confi...
Excerpt: The council managed to recover approximately $400,000 by working with banks and authorities
https://ia.acs.org.au/article/2025/ai-scam-defrauds-noosa-council-of--1-9m.html
AI scam defrauds Noosa Council of $1.9m | Information Age | ACS
Cited text: Photo: Noosa Council · Sengstock explained the fraudsters were successful in spite of Noosa Council having dedicated “processes and procedures to miti...
Excerpt: Despite having dedicated 'processes and procedures to mitigate this type of event'
https://ia.acs.org.au/article/2025/ai-scam-defrauds-noosa-council-of--1-9m.html
Noosa Council reveals social engineering attack that cost council millions—Cyber Daily
Cited text: According to council chief Larry Sengstock, “international criminal gangs” made off with $2.3 million after targeting the council with “social enginee...
Excerpt: international criminal gangs currently under investigation by Australian Federal Police and Interpol
https://www.cyberdaily.au/security/...engineering-attack-that-cost-council-millions
Council loses millions in scam using 'AI techniques' | The Northern Daily Leader | Tamworth, NSW
Cited text: The Noosa Council fraud coincides with the release of the Australian Signals Directorate's annual cyber threat report.
Excerpt: The Noosa Council fraud coincides with the release of the Australian Signals Directorate's annual cyber threat report
https://www.northerndailyleader.com...l-loses-millions-in-scam-using-ai-techniques/
Noosa Council reveals social engineering attack that cost council millions—Cyber Daily
Cited text: The most recent council to fall victim to a cyber attack was Muswellbrook Shire Council, which confirmed it was responding to an attack by the SafePay...
Excerpt: Councils have become particular targets, with Muswellbrook Shire Council recently confirming it was responding to an attack by the SafePay ransomware group that occurred in December 2024
https://www.cyberdaily.au/security/...engineering-attack-that-cost-council-millions
Noosa Council reveals social engineering attack that cost council millions—Cyber Daily
Cited text: “Once being alerted to this fraud; we established our incident crisis response team and immediately reviewed our operating procedures to ensure that p...
Excerpt: 'Once being alerted to this fraud; we established our incident crisis response team and immediately reviewed our operating procedures to ensure that processes were improved, and any risk of future fraud was minimised,'
https://www.cyberdaily.au/security/...engineering-attack-that-cost-council-millions
Seniors Discount Club
Latest Articles
-
When Halloween horror goes too far: Parents push back against ‘graphic’ store displays
- Started by Maan
- Replies: 35
-
-
-
Treat your best mate to a better bowl: Black Hawk’s new High Meat Range is 25% off at Petstock
- Started by Aubrey Razon
- Replies: 0
-
The popular bowl everyone’s rushing to make—and why you can’t find cottage cheese anywhere
- Started by Maan
- Replies: 4
.png){kind=icon}
