Overview

• The council says the incident occurred in December 2024, when about $2.3 million was diverted and roughly $440,000 was later recovered, leaving a net loss of about $1.9 million.
• Queensland Police confirmed the case and the AFP-led Joint Policing Cybercrime Coordination Centre is involved, with one report citing Interpol links.
• Council leaders state there was no breach of IT systems, no data theft, and no impact on public services, a finding they say was validated by external forensic experts.
• Officials allege highly organised overseas criminals used social‑engineering AI techniques, and they report that no council staff were at fault or involved.
• Public disclosure came about 10 months after the incident following police advice, and the council says it has implemented Audit Office recommendations and is installing additional third‑party controls.