“We know it is a sophisticated, state-based cyber actor because of the scale and nature of the targeting and the tradecraft used,” Morrison said on Friday.
“The Australian government is aware of and alert to the threat of cyber attacks.”
He would not say which country was behind the attacks.
Asked if it was China, Morrison said: “The Australian government is not making any public attribution about these matters.
“We are very confident that this is the actions of a state-based actor.
“We have not gone any further than that. I can’t control what speculation others might engage in.”
Morrison said these were not new risks but were specific, targeted activities and he wanted to advise Australians and organisations so they can take action to protect themselves.
He said the investigations conducted so far have not revealed any large-scale personal data breaches.
Australia’s security agencies are working closely with allies and partners to manage it.
“I spoke to (British Prime Minister) Boris Johnson last night about a range of matters, including this one and there are a number of engagements with our allies overnight,” Morrison said.
The prime minister also spoke to Opposition Leader Anthony Albanese on Thursday night on the issue, as well as state and territory leaders.
“Cyber attacks are a real issue,” Albanese told reporters in the NSW town of Thredbo.
“What the evidence is, is that these attacks are expected to be more often.”
Last month a joint statement by the Department of Foreign Affairs and Trade and the Australian Cyber Security Centre said there had been “unacceptable malicious” cyber activity.
“Of particular concern are reports that malicious cyber actors are seeking to damage or impair the operation of hospitals, medical services and facilities, and crisis response organisations outside of Australia,” it said.
This week Lion brewery reported an IT system outage as a result of a ransomware attack.
“In response, we immediately shut down key systems as a precaution,” it said in a statement.
“There is still some way to go before we can resume our normal manufacturing operations and customer service.”
Toll Holdings also reported it was hit twice by cyber attacks in May.
Help our journalists uncover the facts
In times like these InDaily provides valuable, local independent journalism in South Australia. As a news organisation it offers an alternative to The Advertiser, a different voice and a closer look at what is happening in our city and state for free. Any contribution to help fund our work is appreciated. Please click below to donate to InDaily.