A tech firm providing services to Victorian government departments has been hit by a cyber attack. 

PNORS Technology Group owns five companies that provide a range of technology services to hundreds of clients, including Victoria's state government.

The company says two of its businesses, Datatime and Netway, were the target of a cyber attack on November 3.

“The impacted PNORS Technology Group businesses deal with document and data capture, digital conversion and managed IT support for a number of external clients, including government departments,” PNORS chief executive Paul Gallo said.

“Initial investigations by cyber security experts indicated this incident was limited to systems being encrypted and locked.

“However, overnight the criminals behind the cyber attack released to the company in a private communication a sample of what is believed to be stolen data.”

The Victorian Department of Premier and Cabinet (DPC) says it is yet to work out whether data held by the state had been exposed in the breach.

The government is “continuing to provide support to PNORS Technology Group to determine the extent of the information breach and to prevent further incidents”, according to a DPC spokesperson. 

“Protecting Victorian data and systems is our highest priority,” the DPC spokesperson said in a statement.

“If it is determined that Victorian government data has been exposed as a result of this breach, departments will notify impacted individuals and provide advice on steps they can take to minimise any risk.”

PNORS says it has contacted state and federal police, engaged external cybersecurity experts, and notified the Office of Australian Information Commissioner.

“The extent of the data breach is still being investigated and we are working closely with all authorities to assess how many of our clients have been impacted and the nature of the data that has been stolen,” Mr Gallo said in a statement.

“When we were informed about the cyber attack we immediately shut down and isolated all our internal systems and took further measures to secure our network and data, along with pausing all data processing.”

The DPC says people should visit IDCARE for information about how to protect personal information and ScamWatch for information about online scams.