Legacy IT stocktake missing the mark post-Medicare AI breach, warns research

SMC - Solution Minds Consulting

• Following the Medicare AI breach, Home Affairs has directed federal agencies to list legacy IT systems by 31 March 2027.
• New research from Solution Minds Consulting (SMC) reveals system age was documented in only 41% of critical decisions about older systems.
• Unclear system ownership was documented in 73% of cases, and manual workarounds in 91%.
• OpenAI also disclosed a breach of a NSW parks website; the government directive covers federal agencies only.

The federal government’s response to the Medicare AI breach risks focusing on the wrong priorities, new research from independent AI and enterprise software advisory firm Solution Minds Consulting (SMC) warns. Following an OpenAI agent's access to a Medicare data portal via legacy systems, as described by Finance Minister Katy Gallagher, Home Affairs has ordered federal agencies to list their ageing IT systems by 31 March 2027, including their age and support status.

However, SMC’s research, Beyond the Legacy Stocktake, found that system age and support status were among the least documented factors in actual decisions about older systems, appearing in only 41% of engagements.

More fundamental issues emerged instead. In nearly three-quarters of engagements, ownership of the system, process, or data was unclear. In nine out of ten cases, staff relied on manual work, spreadsheets, and workarounds to maintain systems. Furthermore, every engagement documented problems with integration, data quality, and governance.

“A stocktake simply lists what you have; it doesn’t dictate the next steps,” said Jamon Johnston, CEO and Founder of SMC. “The real value lies in deciding which systems to keep, fix, or replace, and ensuring clear accountability for those decisions.”

Mile Dimkovski, SMC’s Executive Director, added, “When we reviewed our engagements, the age of a system was rarely the deciding factor. Instead, decisions hinged on issues like untrusted data, difficult interfaces, reliance on workarounds, and the organisation’s readiness for change.”

The current government directive applies only to federal agencies. OpenAI recently disclosed that its agents also accessed a NSW National Parks web app, a state system not covered by the order. Crucially, the directive does not extend to banks, insurers, retailers, or universities, which also rely on long-lived systems and face similar risks.

At this week's parliamentary hearing, OpenAI's chief strategy officer, Jason Kwon, could not confirm whether the company's agents could reach high-security infrastructure such as a gas plant. "It's going to depend on the safeguards and the infrastructure and the security controls that that particular company or provider has in place," he said. That places the onus on each organisation, in government or not.

“These challenges are not confined to Canberra,” Mr Johnston noted. “Many businesses in our research faced the same issues: ambiguous system ownership, unreliable data, and staff resorting to manual processes.”

Mr Dimkovski urged organisations to take a comprehensive approach: “Run the stocktake. Then, for each critical system, clearly document ownership, dependencies, existing issues, and a realistic plan for response.”

Acting Home Affairs Minister Richard Marles stated, “We can’t wait for an old system to fail before replacing it.” SMC’s research underscores that the strategy for replacement is as vital as the timing.

The Medicare breach itself only came to light because OpenAI self-reported the incident nearly three months after it occurred. “The risks boards should truly worry about are the ones that go unnoticed,” Mr Dimkovski concluded. “Every organisation needs to identify its vulnerable older systems and establish who would notice if something went wrong.”

The research, which analysed 22 enterprise-system engagements in Australia and New Zealand between 2021–2026, offers five pathways and nine questions for organisations to consider before major system decisions. It is available at sm-c.com.au/beyond-the-legacy-stocktake.


About SMC: Solution Minds Consulting (SMC) is an independent enterprise software and AI advisory firm in Australia and New Zealand, founded in 2006 by Jamon Johnston, a former Director at Deloitte Consulting. SMC works exclusively on the client side and does not sell software or represent vendors. It provides software selection, vendor negotiation, implementation oversight and transformation advice across ERP, HCM and payroll, CRM, asset management, supply chain, planning and forecasting, and data and AI systems. SMC works with mid-size and large organisations in business, not-for-profit and government. Its 2026 research, Beyond the Legacy Stocktake, examines what drives decisions to retain, fix or replace core systems. sm-c.com.au 

Ruth Hackel

Senior Marketing and Communications Manager

[email protected]