David Shoebridge (NSW, Australian Greens) Share this | Hansard source

Minister, in those circumstances, is it true that if a corporation had put measures in place but not sufficient measures, and maybe therefore had had a hard to determine but fairly modest benefit from an underspend in the IT, yet they may have suffered a huge commercial loss with customers leaving and remedies being put in place as a result of an attack on their IT, and therefore be potentially tens or hundreds of millions in the red, that they'll be perceived as having received a benefit and therefore will be potentially liable for the 13G(3) penalty?