A targeted phishing attack on staff at Service NSW that led to the theft of more than 500,000 documents containing personal information relating to 186,000 people could have been prevented if simple security measures were followed.

Service NSW is the main customer service hub of the New South Wales government responsible for managing drivers’ licences and car, firearm and birth registrations, among other things.

In April, Service NSW reported it had been subject to a phishing attack where attackers send emails appearing to be legitimate emails but with links to sites that collect login information and compromise those email addresses.

In total, 47 staff accounts were accessed, and after four months of investigation, Services NSW reported on Monday that after examining the 3.8m documents in the email accounts of those staff, around 500,000 documents contained personal information and 186,000 customers will be notified about what data may have been obtained.

The incident happened shortly after Service NSW began using Office365, Microsoft’s cloud-based email and office software suite. Staff had not yet switched on multi-factor authentication, which would have required any people obtaining logins to verify their identity another way beyond just their password.

The head of Cyber Security NSW, Tony Chapman, told Guardian Australia that multi-factor authentication could have prevented the majority of the incidents occurring in NSW government agencies last year.

“My team last year had determined that 61% of incidents reported to Cyber Security NSW would have been prevented if multi-factor authentication was in place,” he said. “So you can imagine it’s a key driver for me to educate across the sector.”

Chapman said there was also an issue with staff using the same password on their personal and work email accounts.

What made the breach that much worse was the sheer volume of documents staff were sharing over email, leaving that much personal information vulnerable to attack.

“Service [NSW] had been using email to share data within the agency [and] with other agencies, since it was established because it was efficient to do so, and at times it was the only method that I had available sharing that information,” he said.

“We shouldn’t underestimate the volume of data that was at play here.”

The chief executive of Service NSW, Damon Rees, has said some of the data includes handwritten notes, forms, scans, and records of transaction applications.

Service NSW also indicated firearm registration information could be included in the data stolen.

“In parallel with the forensic investigation into the cyber incident, Service NSW worked with NSW Police and the Firearms Registry on securing customer information related to firearms licences or permits,” a spokesman said.

Chapman said he wasn’t prepared to attribute the attack but said it was most likely criminals rather than sophisticated actors, such as a foreign nation.

“The traits of this suggest it would be to monetise this information.”

Attacks like this occur on a daily basis for all levels of government, and it is part of the reason Cyber Security NSW was established last year to protect where possible, and mitigate the harm as quickly as possible when attacks do occur, Chapman said.

“It’s not a matter if, it is a matter of when,” he said.

The NSW government in June announced $240m investment in the state’s cyber security capability, amid reports of government agencies struggling to meet new mandatory requirements for cyber resilience.

Chapman said as part of that funding, in addition to Services NSW looking at ways to stop sending as many documents over email, agencies were provided funding to decentralise data storage.

As part of Cyber Security NSW’s role, the organisation alerts staff across government to issues including phishing scams and does simulations of such scams, but Chapman said he was not a fan, and preferred to work with the behavioural insights in the NSW government to find a better way to change behaviour.

“I personally have a view in relation to tricking people into that … the analogy I use is that we don’t teach people to drive by time to crash the car,” he said.

For customers who had their information stolen, they will be informed over the next three months via registered mail about what data has been taken, and IDCARE will provide support to people who need advice on what to do.