[{"data":1,"prerenderedAt":2366},["ShallowReactive",2],{"navigation":3,"socials":68,"all-posts-elena":83},{"id":4,"extension":5,"footer":6,"header":56,"meta":65,"stem":66,"__hash__":67},"navigation\u002Fnavigation.yml","yml",[7,26,38],{"label":8,"items":9,"path":25},"Web development",[10,13,16,19,22],{"label":11,"path":12},"Vue web development","\u002Fvue-js-development-services",{"label":14,"path":15},"React development services","\u002Freact-js-development-services",{"label":17,"path":18},"Laravel development services","\u002Flaravel-development-services",{"label":20,"path":21},"Shopify developers Melbourne","\u002Fshopify",{"label":23,"path":24},"Next.js developers Melbourne","\u002Fnext-js-framework","",{"label":27,"items":28,"path":25},"Cyber security",[29,32,35],{"label":30,"path":31},"Cyber security for small business","\u002Fcyber-security\u002Fsmall-business",{"label":33,"path":34},"Lessons from famous breaches","\u002Fcyber-security\u002Fbreach-lessons",{"label":36,"path":37},"Free cyber health check","\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check",{"label":39,"items":40},"Navigate",[41,44,47,50,53],{"label":42,"path":43},"Home","\u002F",{"label":45,"path":46},"Case Studies","\u002Fcase-studies",{"label":48,"path":49},"Cyber Security","\u002Fcyber-security",{"label":51,"path":52},"Contact Us","\u002Fcontact",{"label":54,"path":55},"Editorial Policy","\u002Feditorial-policy",[57,60,61,62],{"label":58,"path":59},"Web Development","\u002Fweb-development",{"label":45,"path":46},{"label":48,"path":49},{"label":63,"path":64},"About","\u002Fabout",{},"navigation","vaEm85Hrq3ctMNbTgmkywbdLEBklhE1-5zsuR9ZI5Oo",{"id":69,"extension":5,"items":70,"meta":80,"stem":81,"__hash__":82},"socials\u002Fsocials.yml",[71,74,77],{"type":72,"link":73},"facebook","https:\u002F\u002Fwww.facebook.com\u002Fitclub.com.au",{"type":75,"link":76},"linkedin","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fitclub\u002Fabout\u002F",{"type":78,"link":79},"behance","https:\u002F\u002Fwww.behance.net\u002Felenaitclub\u002F",{},"socials","R3zh7G2Yeky6IFraIEG2izmfHXa3EG7r0rHl4YbjpWk",[84,717,1303,1863],{"id":85,"title":86,"authorBio":87,"body":88,"coverImage":697,"date":698,"description":699,"extension":700,"faq":701,"heroImage":697,"lastReviewed":702,"meta":703,"metadata":704,"navigation":706,"path":707,"readingTime":708,"reviewedAgainst":709,"seo":710,"sitemap":711,"stem":712,"summary":713,"tags":714,"thumbnail":697,"__hash__":716},"blog\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach.md","Latitude Financial Data Breach: Lessons for Small Businesses","Written by Elena Osipova, CPA, an emerging cyber security practitioner with professional background in finance, accounting and business operations. She writes about financial data breaches, cyber security governance and practical security controls for Australian small businesses.",{"type":89,"value":90,"toc":679},"minimark",[91,95,101,104,126,129,132,135,140,143,146,197,200,203,206,210,314,318,325,346,349,353,385,389,425,429,432,458,462,518,522,525,530,544,548,586,590,593,613,617,620,623,631,635],[92,93,94],"p",{},"In March 2023, Latitude Financial suffered what remains one of the largest data breaches in Australian history.",[96,97,98],"blockquote",{},[92,99,100],{},"Latitude Financial is the ASX-listed lender behind Gem, GO Mastercard and 28° Global. It provides personal loans, credit cards and point-of-sale interest-free finance to around 2.8 million customer accounts across Australia and New Zealand.",[92,102,103],{},"An attacker who compromised one of Latitude's vendors obtained Latitude employee login credentials and used them to extract customer data from two other service providers. The stolen data included:",[105,106,107,111,114,117,120,123],"ul",{},[108,109,110],"li",{},"~7.9 million Australian and NZ driver licence numbers",[108,112,113],{},"~103,000 copies of driver licences or passports",[108,115,116],{},"~53,000 passport numbers",[108,118,119],{},"~6.1 million additional records, some dating back to at least 2005",[108,121,122],{},"income and expense information used in ~900,000 loan applications, including - ~308,000 bank account numbers and ~143,000 credit card or credit card account numbers;",[108,124,125],{},"less than 100 customers with monthly financial statements.",[92,127,128],{},"Many affected people were former customers and applicants, and some information dated back nearly two decades.",[92,130,131],{},"Due to its impact, this breach is among major Australian breaches along with Optus and Medibank, intensifying the debate about privacy reform, data retention and cyber security.",[92,133,134],{},"The weaknesses that contributed to the impact of this breach - third-party access, one compromised account reaching multiple sources of sensitive information, and retaining large volumes of historical data - can exist in businesses of every size. And as for small businesses, there are usually fewer designated defences available for IT and security.",[136,137,139],"h2",{"id":138},"what-happened","What happened",[92,141,142],{},"On 16 March 2023, Latitude Financial entered a trading halt at ASX and disclosed a cyberattack, describing it as \"sophisticated and malicious\". It was initially disclosed that approximately 103,000 identification documents and 225,000 customer records were stolen.",[92,144,145],{},"By 27 March, Latitude confirmed the theft of records relating to approximately 14 million customer and applicant records. The stolen information included:",[105,147,148,155,161,167,173,179,185,191],{},[108,149,150,154],{},[151,152,153],"strong",{},"Driver licence numbers:"," ~7.9 million Australian and New Zealand",[108,156,157,160],{},[151,158,159],{},"Passport numbers:"," ~53,000 records",[108,162,163,166],{},[151,164,165],{},"Records containing names, addresses, dates of birth and phone numbers:"," ~6.1 million, with some dating back to at least 2005",[108,168,169,172],{},[151,170,171],{},"Images of driver licences or passports:"," 103,000 records",[108,174,175,178],{},[151,176,177],{},"Income and expense information:"," ~900,000 loan applications",[108,180,181,184],{},[151,182,183],{},"Bank account numbers:"," ~308,000 records",[108,186,187,190],{},[151,188,189],{},"Credit card or credit account numbers:","  ~143,000 records",[108,192,193,196],{},[151,194,195],{},"Monthly financial statements:"," less than 100 customers.",[92,198,199],{},"Latitude said bank-account passwords, card expiry dates and three-digit security codes were not compromised.",[92,201,202],{},"Latitude received the ransom demand but refused to pay it, explicitly aligning with the Australian Government's position.",[92,204,205],{},"As of July 2026, no attacker has been publicly identified or charged in connection with this breach.",[136,207,209],{"id":208},"the-timeline","The timeline",[211,212,213,230],"table",{},[214,215,216],"thead",{},[217,218,219,225],"tr",{},[220,221,222],"th",{},[151,223,224],{},"Date",[220,226,227],{},[151,228,229],{},"Event",[231,232,233,244,254,264,274,284,294,304],"tbody",{},[217,234,235,241],{},[236,237,238],"td",{},[151,239,240],{},"Prior to 16 March 2023",[236,242,243],{},"An attacker obtains a compromised employee credential through one of Latitude’s vendors.  Latitude detects unusual activity and begins its response.",[217,245,246,251],{},[236,247,248],{},[151,249,250],{},"16 March 2023",[236,252,253],{},"Latitude enters an ASX trading halt and publicly discloses the breach. Early findings: ~330,000 customers and applicants affected.",[217,255,256,261],{},[236,257,258],{},[151,259,260],{},"27 March 2023",[236,262,263],{},"The full scale of the breach disclosed: ~14 million records.",[217,265,266,271],{},[236,267,268],{},[151,269,270],{},"11 April 2023",[236,272,273],{},"Latitude confirms a ransom demand and refuses to pay.",[217,275,276,281],{},[236,277,278],{},[151,279,280],{},"April - May 2023",[236,282,283],{},"~6 weeks of severe business disruption: new lending paused, collections interruptions.",[217,285,286,291],{},[236,287,288],{},[151,289,290],{},"May 2023",[236,292,293],{},"The OAIC and NZ Privacy Commissioner open a joint investigation into Latitude's information handling.",[217,295,296,301],{},[236,297,298],{},[151,299,300],{},"Aug 2023",[236,302,303],{},"Latitude reports $76M of pre-tax cyber-related costs and provisions related to the incident and $98.2M statutory loss after tax.",[217,305,306,311],{},[236,307,308],{},[151,309,310],{},"2023 - 2024",[236,312,313],{},"Gordon Legal and Hayden Stephens and Associates lodged a representative complaint with the OAIC on behalf of affected individuals.",[136,315,317],{"id":316},"how-the-attacker-gained-access","How the attacker gained access",[92,319,320,321,324],{},"Based on Latitude’s public disclosures, the incident began with a ",[151,322,323],{},"third-party credential compromise",", rather than a technical exploit. Here’s how the cybercriminals got in:",[326,327,328,334,340],"ol",{},[108,329,330,333],{},[151,331,332],{},"Third-party compromise."," The attack originated from one of Latitude’s major vendors.",[108,335,336,339],{},[151,337,338],{},"Theft of a valid login credential."," From the vendor environment, the attacker obtained active credentials belonging to a Latitude employee.",[108,341,342,345],{},[151,343,344],{},"Large-scale data theft."," The attacker used that credential to gain unauthorised access to personal information of current and historical customers and applicants, resulting in approximately 14 million records stolen.",[92,347,348],{},"Public disclosures have not identified malware, a zero-day vulnerability, or phishing against Latitude employees as the initial access method. The confirmed starting point was a compromised credential obtained through a third party that unlocked almost two decades of identity data.",[136,350,352],{"id":351},"_5-reasons-the-breach-had-such-a-large-impact","5 reasons the breach had such a large impact",[326,354,355,361,367,373,379],{},[108,356,357,360],{},[151,358,359],{},"A third-party compromise reached Latitude."," Based on reports, the attacker obtained a valid employee credential through a compromised third party. This shows how a supplier’s security weakness can become a customer’s security incident. Businesses should know which vendors can access their systems and data, limit that access to what is necessary and remove it when it is no longer needed.",[108,362,363,366],{},[151,364,365],{},"Stolen credentials worked, at scale."," The compromised credential provided sufficient access for the attacker to retrieve large volumes of data. Public information does not establish whether MFA was absent, bypassed or otherwise ineffective. The suspicious activity was not detected or interrupted early enough to prevent large-scale data theft.",[108,368,369,372],{},[151,370,371],{},"Historical data increased the consequences."," Some stolen records dated back to at least 2005 and related to former customers and unsuccessful applicants. Australian Privacy Principle 11.2 generally requires an organisation to take reasonable steps to destroy or de-identify personal information no longer needed, unless it must be retained under other legal requirements. In May 2023, the OAIC and New Zealand Privacy Commissioner started a joint investigation into whether Latitude met that obligation.",[108,374,375,378],{},[151,376,377],{},"Valuable identity information was concentrated."," The attackers were able to reach Latitude’s customer and applicant records in the service-provider systems with one set of employee credentials. The stolen information included driver licence and passport details, document images, Medicare information and financial information provided during credit applications. Where retention is legally or operationally necessary, the information should be isolated, encrypted, tightly access-controlled and deleted when the retention requirement ends.",[108,380,381,384],{},[151,382,383],{},"Detection did not prevent large-scale theft."," Latitude detected unusual activity and moved to contain the incident, but substantial information had already been compromised. Businesses should have alerts on unusual behaviour such as mass searches, bulk downloads, large exports, access from new locations and one account rapidly accessing several sensitive systems.",[136,386,388],{"id":387},"what-it-cost","What it cost",[105,390,391,402,408,414,420],{},[108,392,393,394,397,398,401],{},"In August 2023, Latitude reported ",[151,395,396],{},"$76 million in pre-tax March-incident-related costs and provisions",", contributing to a ",[151,399,400],{},"$98.2 million after tax loss from continuing operations for the half-year",".",[108,403,404,407],{},[151,405,406],{},"Business operation disruption:"," For around 6 weeks, Latitude paused the new lending and loan collections were disrupted.",[108,409,410,413],{},[151,411,412],{},"Cost for reimbursing identity document replacement"," for millions of people",[108,415,416,419],{},[151,417,418],{},"Legal and regulatory exposure:"," Serious privacy contraventions can expose a company to substantial civil penalties, although a data breach does not automatically mean that the maximum penalty will apply.",[108,421,422],{},[151,423,424],{},"Reputational damage.",[136,426,428],{"id":427},"what-latitude-did-well","What Latitude did well",[92,430,431],{},"Although the breach exposed serious weaknesses, several aspects of Latitude’s incident response are worth recognising:",[105,433,434,440,446,452],{},[108,435,436,439],{},[151,437,438],{},"Early disclosure:"," Latitude disclosed the cyberattack and entered a trading halt on 16 March 2023 while the investigation was still underway.",[108,441,442,445],{},[151,443,444],{},"Containment and operational action:"," Latitude isolated affected systems, paused parts of its onboarding new customers and worked with cyber security specialists, the ACSC, AFP and other government agencies.",[108,447,448,451],{},[151,449,450],{},"Refusal to pay the ransom:"," Latitude publicly stated that it would not pay the attacker, aligning its position with Australian Government advice.",[108,453,454,457],{},[151,455,456],{},"Support for affected people:"," Latitude offered to reimburse reasonable costs for replacing compromised identity documents and provided information about protective steps customers could take.",[136,459,461],{"id":460},"_9-lessons-for-your-business","9 lessons for your business",[326,463,464,470,476,482,488,494,500,506,512],{},[108,465,466,469],{},[151,467,468],{},"Do not keep data longer than necessary."," Review what personal information your business holds, why it’s needed, and how long it must be retained? Australian Privacy Principle 11.2 generally requires an organisation to take reasonable steps to destroy or de-identify personal information it no longer needs, unless it must retain the information under another legal obligation. Historical information increased the scale of the Latitude breach. Cybercriminals cannot steal data your business no longer holds.",[108,471,472,475],{},[151,473,474],{},"Minimise stored identity documents."," Verify identity without retaining a full document image where the law and business process allow. If retention is required, store only the minimum information, encrypt it, isolate it, restrict access and delete it as soon as the applicable retention period ends.",[108,477,478,481],{},[151,479,480],{},"Your vendors' security affects your business."," Know which third parties hold your data or can access your systems. This may include IT providers, bookkeepers and software platforms. Require MFA, prompt breach notification and clear security obligations.",[108,483,484,487],{},[151,485,486],{},"Review third-party access regularly."," Keep a record of every vendor account, what it can access and who approved it. Remove access immediately when it is no longer required.",[108,489,490,493],{},[151,491,492],{},"Make stolen credentials insufficient."," Require MFA for remote, administrator and third-party access. Give every account only Limit each account only the access it needs. Set alerts on unusual behaviour, such as new login locations, bulk downloads or access outside expected hours.",[108,495,496,499],{},[151,497,498],{},"Control large data exports."," Restrict who can download or export sensitive information. Set alerts on unusually large downloads, repeated searches or one account accessing several sensitive systems in a short period.",[108,501,502,505],{},[151,503,504],{},"Test your incident response plan."," A written plan is useful only if people know how to use it. Run a simple exercise covering containment, notifications, customer communication and contact with your IT provider.",[108,507,508,511],{},[151,509,510],{},"Decide your ransom position before an incident."," Document who has authority to make the decision and obtain legal, law-enforcement, insurance and incident-response advice. Paying a ransom does not guarantee that stolen data will be deleted, returned or kept private.",[108,513,514,517],{},[151,515,516],{},"Explain that early breach figures may change."," Clearly label early figures as preliminary. Then may change as the forensic investigation progresses.",[136,519,521],{"id":520},"how-cyber-security-frameworks-apply","How cyber security frameworks apply",[92,523,524],{},"While the publicly available information is limited and does not provide enough technical detail to map every stage of the Latitude attack, the incident can still be examined using established cyber security frameworks.",[526,527,529],"h3",{"id":528},"mitre-attck-helps-understand-the-attackers-behaviour","MITRE ATT&CK helps understand the attacker’s behaviour",[105,531,532,538],{},[108,533,534,537],{},[151,535,536],{},"Valid Accounts (T1078):"," This technique is consistent with the publicly known facts because the attacker obtained a valid employee credential to gain unauthorised access to sensitive information.",[108,539,540,543],{},[151,541,542],{},"Data from Information Repositories (T1213):"," The data theft from customer and applicant systems may be consistent with this technique.",[526,545,547],{"id":546},"nist-cybersecurity-framework-20-helps-organise-the-lessons","NIST Cybersecurity Framework 2.0 helps organise the lessons",[105,549,550,556,562,568,574,580],{},[108,551,552,555],{},[151,553,554],{},"Govern:"," Assign responsibility for cyber security, privacy, data retention and third-party risk. Set security requirements for vendors and check that they are followed.",[108,557,558,561],{},[151,559,560],{},"Identify:"," Know what personal information the business holds, where it is stored, why it is needed, who can access it and when it should be deleted.",[108,563,564,567],{},[151,565,566],{},"Protect:"," Use least privilege, strong MFA, encryption, access segmentation and controls that limit large downloads or exports.",[108,569,570,573],{},[151,571,572],{},"Detect:"," Monitor successful and failed logins. Alert on unusual locations, new devices, mass downloads and access across sensitive systems.",[108,575,576,579],{},[151,577,578],{},"Respond:"," Maintain and test an incident-response plan covering containment, legal and privacy assessment, communication and customer support.",[108,581,582,585],{},[151,583,584],{},"Recover:"," Restore services safely, support affected people and update systems, contracts and retention practices after the incident.",[526,587,589],{"id":588},"acscs-essential-eight","ACSC’s Essential Eight",[92,591,592],{},"Although the Essential Eight does not cover every issue raised by this data breach, it is a useful Australian technical baseline. The most relevant strategies include:",[105,594,595,601,607],{},[108,596,597,600],{},[151,598,599],{},"Multi-factor authentication:"," Require MFA for employees, administrators, vendors and access to sensitive systems.",[108,602,603,606],{},[151,604,605],{},"Restrict administrative privileges:"," Give your employees and service providers only the access required for their work. Review privileged access regularly and remove it when it is no longer needed.",[108,608,609,612],{},[151,610,611],{},"Regular backups:"," Maintain protected and tested backups to support operational recovery.",[136,614,616],{"id":615},"final-takeaway","Final takeaway",[92,618,619],{},"The Latitude breach was not only a story about a compromised credential. It also showed how much sensitive information one account could reach, how third-party access can connect multiple systems, and how historical data can increase the harm caused by an incident.",[92,621,622],{},"Small businesses may hold fewer records, but the same risks apply. Know what personal information you hold, remove information you no longer need, limit each account to the minimum access required and monitor unusual activity after login.",[92,624,625,626,630],{},"Use our ",[627,628,629],"a",{"href":37},"DIY cyber security health check"," to review your current controls and identify practical steps for improvement.",[136,632,634],{"id":633},"sources-used","Sources used",[105,636,637,640,643,646,649,652,655,658,661,664,667,670,673,676],{},[108,638,639],{},"Latitude Financial, Cybercrime Update, 20 March 2023",[108,641,642],{},"Latitude Financial, Cybercrime Update, 27 March 2023",[108,644,645],{},"Latitude Financial, Cybercrime Update 11 April 2023",[108,647,648],{},"Latitude Financial, Latitude Cyber Response",[108,650,651],{},"OAIC, Joint Australia-New Zealand investigation into Latitude group",[108,653,654],{},"OAIC, Statement on Latitude Financial data breach",[108,656,657],{},"New Zealand Office of the Privacy Commissioner, New Zealand - Australia investigation into Latitude breach begins",[108,659,660],{},"Latitude Group Holdings, 1H23 Results",[108,662,663],{},"MITRE ATT&CK, Valid Accounts - T1078",[108,665,666],{},"MITRE ATT&CK, Data from Information Repositories - T1213",[108,668,669],{},"NIST, Cybersecurity Framework 2.0",[108,671,672],{},"ASD, ACSC’s Essential Eight Maturity Model",[108,674,675],{},"Australian Government, Australian Privacy Principles Guidelines, Chapter 11",[108,677,678],{},"Gordon Legal, Latitude Financial privacy breach representative complaint",{"title":25,"searchDepth":680,"depth":680,"links":681},2,[682,683,684,685,686,687,688,689,695,696],{"id":138,"depth":680,"text":139},{"id":208,"depth":680,"text":209},{"id":316,"depth":680,"text":317},{"id":351,"depth":680,"text":352},{"id":387,"depth":680,"text":388},{"id":427,"depth":680,"text":428},{"id":460,"depth":680,"text":461},{"id":520,"depth":680,"text":521,"children":690},[691,693,694],{"id":528,"depth":692,"text":529},3,{"id":546,"depth":692,"text":547},{"id":588,"depth":692,"text":589},{"id":615,"depth":680,"text":616},{"id":633,"depth":680,"text":634},"\u002Fcovers\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial.jpg","2026-07-27T00:00:00.000Z","The 2023 Latitude Financial breach exposed millions of customer and applicant records. Learn how third-party access, stolen credentials and excessive data retention increased the impact - and what small businesses should do differently.","md",[],null,{},{"description":705,"title":86},"How the 2023 Latitude Financial incident happened. What Australian small businesses can learn about data retention, vendor access, MFA and breach response.",true,"\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach",10,"Reviewed against current guidance from ASD Australian Cyber Security Centre, the OAIC, NIST CSF 2.0 and MITRE ATT&CK",{"title":86,"description":699},{"loc":707},"cyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach","The 2023 Latitude Financial breach exposed approximately 14 million records, including information dating back to 2005. Here is what Australian businesses can learn about data retention, third-party access, stolen credentials and breach response.",[48,715],"Breach Lessons","TA8niaCikqD3pvid8DbV6jcw4Bh_aFDwyyEIa8P8djs",{"id":718,"title":719,"authorBio":720,"body":721,"coverImage":1288,"date":698,"description":1289,"extension":700,"faq":1290,"heroImage":1288,"lastReviewed":702,"meta":1291,"metadata":1292,"navigation":706,"path":1294,"readingTime":1295,"reviewedAgainst":1296,"seo":1297,"sitemap":1298,"stem":1299,"summary":1300,"tags":1301,"thumbnail":1288,"__hash__":1302},"blog\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank-breach.md","What The Medibank Breach Teaches Small Businesses","Written by Elena Osipova, CPA, an emerging Cyber Security Practitioner. Elena writes about enterprise breaches, cyber security governance and practical security controls to help Australian small businesses improve their own defences.",{"type":89,"value":722,"toc":1272},[723,726,731,734,737,740,742,745,748,751,754,756,922,924,927,947,954,956,988,990,1034,1038,1041,1061,1065,1127,1129,1132,1136,1160,1164,1196,1198,1201,1213,1215,1218,1221,1226,1228],[92,724,725],{},"In October 2022, Medibank, one of Australia's largest private health insurers, disclosed that a cybercriminal had stolen about 520GB of data. The breach affected around 9.7 million current and former Medibank, ahm and international customers and representatives, including people whose sensitive health claims information was exposed.",[96,727,728],{},[92,729,730],{},"Through its Medibank and ahm brands, the group insures millions of people across Australia.",[92,732,733],{},"The weaknesses that contributed to this breach were not unusual. According to allegations filed by the Australian Information Commissioner, an employee of a Medibank IT contractor saved Medibank credentials in his browser profile on a work computer. When he signed into the same browser profile on a personal computer, the credentials synchronised to that device and were later stolen by malware.",[92,735,736],{},"A cybercriminal then used the compromised credentials to access Medibank’s remote-access VPN, which did not require MFA for that login method. Medibank’s security software raised alerts about suspicious activity, but they were delayed to triage for weeks.",[92,738,739],{},"Three basic controls failed in a large organisation. Every one of them could be missing in small businesses too.",[136,741,139],{"id":138},[92,743,744],{},"On 13 October 2022, Medibank disclosed unusual activity on its network and initially said there was no evidence that customer data had been removed. On 19 and 22 October, an attacker contacted Medibank and supplied sample files. Medibank later confirmed that information connected to around 9.7 million people had been stolen. The OAIC alleges that about 520GB of data was exfiltrated between late August and 13 October 2022.",[92,746,747],{},"The attacker demanded US$10 million. Medibank refused to pay, explaining that payment could not guarantee the return or deletion of the data and might encourage further extortion.",[92,749,750],{},"From 9 November to 1 December 2022, stolen information was published on a dark-web leak site in stages, fully releasing the dataset. Published files included highly sensitive health claims information, including records about HIV, drug and alcohol treatment, mental health, and abortions. Australian authorities later attributed the attack to Russian national Aleksandr Ermakov, who was associated with the REvil cybercrime group.",[92,752,753],{},"In January 2024, Australia used its cyber sanctions framework for the first time and designated Aleksandr Ermakov for his role in the Medibank breach, imposing targeted financial sanctions and a travel ban. Dealing with a designated person or their assets can be a criminal offence carrying severe penalties, including up to 10 years’ imprisonment for an individual.",[136,755,209],{"id":208},[211,757,758,770],{},[214,759,760],{},[217,761,762,766],{},[220,763,764],{},[151,765,224],{},[220,767,768],{},[151,769,229],{},[231,771,772,782,792,802,812,822,832,842,852,862,872,882,892,902,912],{},[217,773,774,779],{},[236,775,776],{},[151,777,778],{},"Prior to 7 August 2022",[236,780,781],{},"A contractor employee saved Medibank credentials in a browser profile on a work computer. The credentials were later synchronised to his personal computer.",[217,783,784,789],{},[236,785,786],{},[151,787,788],{},"Around 7 August 2022",[236,790,791],{},"Malware on the personal computer stole the Medibank credentials.",[217,793,794,799],{},[236,795,796],{},[151,797,798],{},"12 August 2022",[236,800,801],{},"The attacker tested the stolen admin credentials against Medibank’s Microsoft Exchange server.",[217,803,804,809],{},[236,805,806],{},[151,807,808],{},"Around 23 August 2022",[236,810,811],{},"The attacker first logged in to Medibank’s GlobalProtect VPN, with no MFA required.",[217,813,814,819],{},[236,815,816],{},[151,817,818],{},"24 - 25 August 2022",[236,820,821],{},"Medibank’s security software generated alerts, sending them to an IT operations mailbox. The OAIC alleges they were not appropriately triaged or escalated.",[217,823,824,829],{},[236,825,826],{},[151,827,828],{},"25 August - 13 October 2022",[236,830,831],{},"The attacker accessed Medibank's internal systems and exfiltrated about 520GB of data.",[217,833,834,839],{},[236,835,836],{},[151,837,838],{},"11 October 2022",[236,840,841],{},"Medibank triaged a high-severity alert and engaged its incident-response partner.",[217,843,844,849],{},[236,845,846],{},[151,847,848],{},"13 October 2022",[236,850,851],{},"Medibank publicly discloses the incident, initially stating that there was no evidence that customer data had been removed.",[217,853,854,859],{},[236,855,856],{},[151,857,858],{},"19 and 22 October 2022",[236,860,861],{},"The attacker contacted Medibank and supplied sample files with stolen data.",[217,863,864,869],{},[236,865,866],{},[151,867,868],{},"7 November 2022",[236,870,871],{},"Medibank confirmed the scale of the breach: 9.7 million people and publicly refused to pay the ransom.",[217,873,874,879],{},[236,875,876],{},[151,877,878],{},"9 November - 1 December 2022",[236,880,881],{},"Stolen information was published on the dark web in stages, ending with the full 520GB released.",[217,883,884,889],{},[236,885,886],{},[151,887,888],{},"27 June 2023",[236,890,891],{},"APRA announced a $250M increase in Medibank’s capital adequacy requirement until remediation was completed to APRA’s satisfaction.",[217,893,894,899],{},[236,895,896],{},[151,897,898],{},"23 January 2024",[236,900,901],{},"Australia imposed its first cyber sanction, designating Aleksandr Ermakov for his role in the breach.",[217,903,904,909],{},[236,905,906],{},[151,907,908],{},"5 June 2024",[236,910,911],{},"The OAIC files civil penalty proceedings in the Federal Court over alleged failure to take reasonable steps to protect personal information.",[217,913,914,919],{},[236,915,916],{},[151,917,918],{},"As of July 2026",[236,920,921],{},"The OAIC proceedings continued, and the Medibank class action remained listed as open in the Federal Court.",[136,923,317],{"id":316},[92,925,926],{},"Based on the OAIC’s allegations and Medibank’s public updates, the incident began with stolen credentials, remote access without MFA and an account with extensive privileges. Here’s how the hacker gained access:",[326,928,929,935,941],{},[108,930,931,934],{},[151,932,933],{},"Credential theft through infostealer malware."," TMedibank credentials saved in a contractor employee’s browser profile were synchronised to his personal computer and were stolen by malware.",[108,936,937,940],{},[151,938,939],{},"Remote access without MFA."," The VPN was configured to accept a username and password and did not require MFA.",[108,942,943,946],{},[151,944,945],{},"Broad access and delayed escalation."," The compromised admin account could access most Medibank systems. The OAIC alleges that security alerts were generated from 24 August onwards but were not appropriately triaged or escalated, allowing the hacker to locate and exfiltrate about 520GB of data over seven weeks.",[92,948,949,950,953],{},"The publicly available evidence describes a ",[151,951,952],{},"data-theft and extortion"," incident rather than ransomware with encrypted systems. The attacker simply used valid credentials to access systems and steal data, then demanded payment to prevent publication.",[136,955,352],{"id":351},[326,957,958,964,970,976,982],{},[108,959,960,963],{},[151,961,962],{},"No MFA on remote access."," A username and password were enough for the hacker to access Medibank’s systems. MFA would have added an important barrier and may have prevented or limited the initial access.",[108,965,966,969],{},[151,967,968],{},"An unmanaged personal device."," Corporate credentials were synchronised to a personal computer outside Medibank’s managed environment, where malware stole them.",[108,971,972,975],{},[151,973,974],{},"Poor alert response."," Detection software generated alerts, but the process for reviewing, triaging and escalating them did not work as intended.",[108,977,978,981],{},[151,979,980],{},"One account had very broad access."," The service-desk account had access to \"most, if not all, systems\", so one stolen credential became keys to the whole building.",[108,983,984,987],{},[151,985,986],{},"Known weaknesses were not fixed in time."," The OAIC alleges Medibank knew about the security gaps, including the MFA gap, through its cyber security audits, and failed to fix them in time.",[136,989,388],{"id":387},[105,991,992,998,1004,1010,1016,1022,1028],{},[108,993,994,997],{},[151,995,996],{},"Direct response and remediation costs reached tens of millions of dollars"," across several financial years, before any final litigation outcomes.",[108,999,1000,1003],{},[151,1001,1002],{},"Blackmail and ransom demands:"," Medibank refused the US$10M ransom,  and the stolen data was later published.",[108,1005,1006,1009],{},[151,1007,1008],{},"APRA's $250 million capital adequacy adjustment:"," This was not a fine, it required Medibank to hold additional capital until APRA was satisfied with the remediation program.",[108,1011,1012,1015],{},[151,1013,1014],{},"Regulatory and legal scrutiny:"," The ongoing OAIC civil penalty proceedings and a Federal Court class action, still listed as open.",[108,1017,1018,1021],{},[151,1019,1020],{},"Harm to affected people:",": Published information included identity details and sensitive health claims data, creating risks of fraud, scams, blackmail, identity theft and emotional distress for the affected individuals.",[108,1023,1024,1027],{},[151,1025,1026],{},"Wider impact:",": The breach contributed to national debate about privacy, cyber security and ransomware. In 2024, Australia imposed its first cyber sanction in response to the incident.",[108,1029,1030,1033],{},[151,1031,1032],{},"Reputational damage:"," The incident affected customer trust and kept Medibank under public, regulatory and legal scrutiny for years.",[136,1035,1037],{"id":1036},"what-medibank-did-well","What Medibank did well",[92,1039,1040],{},"Although the breach exposed serious weaknesses and early breach figures changed as the incident investigation progressed, several aspects of Medibank’s incident response are worth recognising:",[105,1042,1043,1046,1049,1052,1055,1058],{},[108,1044,1045],{},"Medibank provided frequent public updates as the breach scope became clearer.",[108,1047,1048],{},"It also notified regulators and law-enforcement agencies.",[108,1050,1051],{},"Medibank engaged external cyber incident-response specialists.",[108,1053,1054],{},"It refused to pay ransom, aligning with the Australian Government view.",[108,1056,1057],{},"Medibank also offered support measures, including identity monitoring and hardship support for affected customers",[108,1059,1060],{},"It also committed to remediation and security investment.",[136,1062,1064],{"id":1063},"_10-lessons-for-your-business","10 lessons for your business",[326,1066,1067,1073,1079,1085,1091,1097,1103,1109,1115,1121],{},[108,1068,1069,1072],{},[151,1070,1071],{},"Mandatory MFA."," If one control defines this breach, it's this. Enforce mandatory MFA for VPNs, emails, cloud systems, admin accounts, contractor accounts and third-party support access.",[108,1074,1075,1078],{},[151,1076,1077],{},"Properly manage contractor access."," Administrator access should be role-based rather than universal across internal systems. Privileged access should only be granted when required, time-limited, approved, monitored and reviewed regularly. Contractors should not have privileged access to all systems and databases.",[108,1080,1081,1084],{},[151,1082,1083],{},"Require managed devices for corporate access."," Personal or unmanaged devices should not access sensitive systems unless strong technical controls are in place. Access should be limited to devices that are managed, compliant, patched and monitored.",[108,1086,1087,1090],{},[151,1088,1089],{},"Apply least privilege."," Give each user only the access needed for their role. Review privileged access regularly and remove it when it is no longer required.",[108,1092,1093,1096],{},[151,1094,1095],{},"Strengthen browser and credential security."," Do not allow corporate credentials to be stored in browsers. Use an approved password manager and configure managed browsers to control password saving and profile synchronisation.",[108,1098,1099,1102],{},[151,1100,1101],{},"Every alert needs an owner."," Decide who acts on warnings from your antivirus, bank and software - and how they should respond to them.",[108,1104,1105,1108],{},[151,1106,1107],{},"Reduce sensitive data exposure."," Keep only the information you need, restrict access, separate high-risk data, encrypt it where appropriate and monitor unusual access or large data transfers.",[108,1110,1111,1114],{},[151,1112,1113],{},"Network segmentation."," Consider separating your network into secure zones to reduce access to sensitive data.",[108,1116,1117,1120],{},[151,1118,1119],{},"Act on cyber security findings."," The OAIC alleges that Medibank's cyber security audits flagged the MFA gap. Treat audit findings, penetration-test results and insurer questionnaires as actions with owners, deadlines and management oversight.",[108,1122,1123,1126],{},[151,1124,1125],{},"Train employees and contractors."," Cover secure credential storage, approved password managers, MFA methods, risk of browser synchronisation, phishing methods, incident reporting and how to correctly respond to credential theft attempts.",[136,1128,521],{"id":520},[92,1130,1131],{},"While the publicly available information does not provide every technical detail of the Medibank attack, the incident can still be examined using established cyber security frameworks. This can help turn the incident into a structured set of lessons.",[526,1133,1135],{"id":1134},"mitre-attck-helps-understand-the-attackers-behaviours","MITRE ATT&CK helps understand the attacker's behaviours",[105,1137,1138,1144,1150,1155],{},[108,1139,1140,1143],{},[151,1141,1142],{},"Credentials from Web Browsers (T1555.003):"," The OAIC alleges that Medibank credentials saved in a contractor’s work browser profile were synchronised to a personal computer and later stolen by information-stealing malware.",[108,1145,1146,1149],{},[151,1147,1148],{},"External Remote Services (T1133):"," The attacker allegedly used the stolen credentials to connect to Medibank systems through its GlobalProtect VPN.",[108,1151,1152,1154],{},[151,1153,536],{}," The attacker used an active Medibank administrator account that allowed the login to appear similar to authorised activity.",[108,1156,1157,1159],{},[151,1158,542],{}," After entering the environment, the attacker allegedly accessed internal systems and databases containing customer identity and health claims information.",[526,1161,1163],{"id":1162},"nist-cybersecurity-framework-20-helps-organise-management-responsibilities","NIST Cybersecurity Framework 2.0 helps organise management responsibilities",[105,1165,1166,1171,1176,1181,1186,1191],{},[108,1167,1168,1170],{},[151,1169,554],{}," Assign responsibility for cyber security, privacy and third-party access. Set clear security requirements for contractors and ensure that known audit findings are recorded, prioritised and fixed.",[108,1172,1173,1175],{},[151,1174,560],{}," Know which accounts have broad access, which devices can connect remotely, where sensitive customer information is stored and which systems would create the greatest harm if compromised.",[108,1177,1178,1180],{},[151,1179,566],{}," Require strong MFA for remote and privileged access. Use managed devices, approved password manager software, least privilege, network segmentation and controls that limit access to sensitive databases.",[108,1182,1183,1185],{},[151,1184,572],{}," Monitor VPN access, privileged-account activity, unusual devices, large searches or exports and suspicious connections between internal systems. Ensure every important alert has an owner and a defined escalation process.",[108,1187,1188,1190],{},[151,1189,578],{}," Maintain and test an incident-response plan. It should cover disabling compromised accounts, revoking active sessions, isolating affected systems, investigating alerts, notifying regulators and communicating with affected customers.",[108,1192,1193,1195],{},[151,1194,584],{}," Restore affected services safely, support affected people, review what went wrong and improve access controls, monitoring, contractor arrangements and incident-response procedures.",[526,1197,589],{"id":588},[92,1199,1200],{},"Although the Essential Eight does not cover every issue seen in this breach, it provides a useful Australian technical baseline. The most relevant to Medibank’s breach strategy include:",[105,1202,1203,1208],{},[108,1204,1205,1207],{},[151,1206,599],{}," Require MFA for VPN access, privileged accounts, contractors and systems holding sensitive information.",[108,1209,1210,1212],{},[151,1211,605],{}," Give employees and contractors only the access needed for their work. Use separate privileged accounts, review access regularly and remove it when it is no longer required.",[136,1214,616],{"id":615},[92,1216,1217],{},"The Medibank breach is sometimes framed as the work of a sophisticated Russian hacker. The practical lesson is simpler: browser-synchronised credentials were stolen from a personal device, remote access did not require MFA for the login method used, an admin account had extensive access, and security alerts were not promptly handled.",[92,1219,1220],{},"Small businesses may have fewer IT and security resources, but the same risks still matter. Know who can access your systems, require MFA, use managed devices, limit each account to the minimum access required, control browser synchronisation and make sure every important security alert has an owner.",[92,1222,625,1223,1225],{},[627,1224,629],{"href":37}," to review your current controls and identify practical steps to protect your business.",[136,1227,634],{"id":633},[105,1229,1230,1233,1236,1239,1242,1245,1248,1251,1254,1257,1260,1263,1266,1269],{},[108,1231,1232],{},"Office of the Australian Information Commissioner, Civil penalty action against Medibank and the filed concise statement (June 2024).",[108,1234,1235],{},"Australian Prudential Regulation Authority, APRA takes action against Medibank Private in relation to cyber incident” (27 June 2023).",[108,1237,1238],{},"Australian Government - Department of Foreign Affairs and Trade, Cyber sanctions in response to Medibank Private cyber attack (23 January 2024).",[108,1240,1241],{},"Australian Government - Department of Foreign Affairs and Trade, Significant cyber incidents sanctions framework.",[108,1243,1244],{},"Australian Government - Department of Foreign Affairs and Trade — Guidance Note: Cyber sanctions.",[108,1246,1247],{},"Federal Court of Australia, Current class actions - McClure v Medibank Private Limited, VID64\u002F2023.",[108,1249,1250],{},"Medibank, Cybercrime updates published from 13 October to 1 December 2022.",[108,1252,1253],{},"MITRE ATT&CK Enterprise framework, Credentials from Web Browsers, T1555.003.",[108,1255,1256],{},"MITRE ATT&CK Enterprise framework, External Remote Services, T1133.",[108,1258,1259],{},"MITRE ATT&CK Enterprise framework, Valid Accounts, T1078.",[108,1261,1262],{},"MITRE ATT&CK Enterprise framework, Data from Information Repositories, T1213.",[108,1264,1265],{},"National Institute of Standards and Technology, NIST Cybersecurity Framework 2.0.",[108,1267,1268],{},"ASD’s Australian Cyber Security Centre, Essential Eight explained.",[108,1270,1271],{},"ASD’s Australian Cyber Security Centre, Essential Eight maturity model.",{"title":25,"searchDepth":680,"depth":680,"links":1273},[1274,1275,1276,1277,1278,1279,1280,1281,1286,1287],{"id":138,"depth":680,"text":139},{"id":208,"depth":680,"text":209},{"id":316,"depth":680,"text":317},{"id":351,"depth":680,"text":352},{"id":387,"depth":680,"text":388},{"id":1036,"depth":680,"text":1037},{"id":1063,"depth":680,"text":1064},{"id":520,"depth":680,"text":521,"children":1282},[1283,1284,1285],{"id":1134,"depth":692,"text":1135},{"id":1162,"depth":692,"text":1163},{"id":588,"depth":692,"text":589},{"id":615,"depth":680,"text":616},{"id":633,"depth":680,"text":634},"\u002Fcovers\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank.jpg","How stolen browser-saved credentials, remote access without MFA and missed security alerts contributed to the 2022 Medibank data breach - and what Australian small businesses can learn from it.",[],{},{"description":1293,"title":719},"How the 2022 Medibank data breach happened & what Australian small businesses can learn about contractor access, browser-saved credentials, MFA and security alerts.","\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank-breach",11,"Reviewed against public information from the OAIC, APRA, ASD’s Australian Cyber Security Centre, DFAT, Medibank, MITRE ATT&CK and NIST SCF 2.0",{"title":719,"description":1289},{"loc":1294},"cyber-security\u002Fbreach-lessons\u002Fmedibank-breach","The 2022 Medibank data breach made headlines, but the weaknesses that contributed to it are not unique to large companies. Here are the practical lessons small businesses can take from the incident.",[48,715],"DrwgvJLPjR03gDBSyfBEqBqmq6B3GAzL3RFiqFrTSww",{"id":1304,"title":1305,"authorBio":1306,"body":1307,"coverImage":1831,"date":698,"description":1832,"extension":700,"faq":1833,"heroImage":1831,"lastReviewed":702,"meta":1852,"metadata":1853,"navigation":706,"path":37,"readingTime":708,"reviewedAgainst":1856,"seo":1857,"sitemap":1858,"stem":1859,"summary":1832,"tags":1860,"thumbnail":1831,"__hash__":1862},"blog\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check.md","The DIY Cyber Security Health Check for Small Business","Written by Elena Osipova, CPA, an emerging Cyber Security Practitioner. Elena writes about cyber security governance and practical security controls for Australian small businesses.",{"type":89,"value":1308,"toc":1815},[1309,1312,1318,1324,1330,1333,1337,1348,1394,1397,1417,1421,1428,1432,1435,1475,1479,1509,1513,1551,1555,1589,1594,1598,1607,1618,1621,1663,1670,1677,1681,1684,1687,1710,1714,1717,1720,1729,1738,1742,1745,1756,1759,1773,1775,1777],[92,1310,1311],{},"You don't need a consultant to find many of your most common cyber risks. One structured afternoon can uncover preventable gaps, such as a former employee's active login, a backup that doesn't restore files, or a payment process that trusts email alone.",[92,1313,1314,1317],{},[151,1315,1316],{},"To complete this checklist, allow around three to four hours",". A very small business may finish much sooner, while a business with more users, devices and cloud services may need additional time. You'll need administrator access to Microsoft 365 or Google Workspace, access to your backup system, and a notepad or spreadsheet for recording your findings.",[92,1319,1320,1323],{},[151,1321,1322],{},"The method matters more than the tools: look at evidence, not memory",". “I think only two people have admin access” is an assumption. Opening the admin panel and counting them gives you a fact. Each step below asks you to check an actual setting, process or record.",[92,1325,1326,1329],{},[151,1327,1328],{},"Write down every issue you find",". Unless some findings appear urgent, don’t stop to fix each issue as you go, or you may burn the whole afternoon on the first item. Fixing them comes later, in priority order shown below.",[92,1331,1332],{},"However, act immediately if you find a clear sign of active compromise. Tis includes an unknown account administrator, an unauthorised payment or an email forwarding rule you did not create.",[136,1334,1336],{"id":1335},"step-1-accounts-and-access-60-minutes","Step 1: Accounts and access - 60 minutes",[92,1338,1339,1340,1343,1344,1347],{},"Open the ",[151,1341,1342],{},"Microsoft 365 Admin Centre"," or ",[151,1345,1346],{},"Google Workspace Admin Console"," and check six things:",[105,1349,1350,1356,1370,1376,1382,1388],{},[108,1351,1352,1355],{},[151,1353,1354],{},"The user list."," Read every name. Is anyone no longer with the business but still active? Is there an account you cannot explain? Record former users for removal. Remove unknown users urgently.",[108,1357,1358,1361,1362,1365,1366,1369],{},[151,1359,1360],{},"MFA coverage."," Confirm that every user is required to use MFA and has completed registration. ",[151,1363,1364],{},"In Microsoft 365",", don’t rely only on the legacy per-user MFA status: MFA may instead be enforced through Security Defaults or Conditional Access. Check both - the organisation-wide policy and the users who have registered. ",[151,1367,1368],{},"In Google Workspace",", check 2-Step Verification enrolment and enforcement.",[108,1371,1372,1375],{},[151,1373,1374],{},"Who's an administrator?"," Count the accounts with administrator roles. There should be very few, and you should be able to explain why each person needs that level of access.",[108,1377,1378,1381],{},[151,1379,1380],{},"Guest and external access."," Review guest users, contractors, delegated mailbox access and connected third-party applications. Remove access that is no longer required.",[108,1383,1384,1387],{},[151,1385,1386],{},"Email forwarding rules."," Check the business owner's and finance mailboxes for rules that forward messages outside the business. Cyber criminals who compromise email accounts may create a hidden forwarding rule. It may remain active after the password is changed. Treat anything you do not recognise as urgent.",[108,1389,1390,1393],{},[151,1391,1392],{},"Account recovery."," For owner and administrator accounts, check the recovery email addresses, phone numbers and backup methods. Remove outdated details. Store emergency recovery codes securely and make sure the business - not one employee personally - controls the recovery process.",[92,1395,1396],{},"Other important account checks:",[105,1398,1399,1405,1411],{},[108,1400,1401,1404],{},[151,1402,1403],{},"Email domain protection."," If your business uses its own email domain, ask your email provider or IT administrator to confirm that SPF, DKIM and DMARC are configured correctly. These help other email systems recognise messages that falsely claim to come from your domain.",[108,1406,1407,1410],{},[151,1408,1409],{},"Domain-name protection."," Sign in to your domain registrar and confirm that your business controls the account, MFA is turned on, the recovery details are current and automatic renewal is enabled. Losing control of your domain can affect your website, email and password resets.",[108,1412,1413,1416],{},[151,1414,1415],{},"Passwords and shared accounts."," Check whether staff reuse passwords or share one login. Each person should have their own account. All important accounts should use unique passwords stored in a reputable password manager.",[526,1418,1420],{"id":1419},"evidence-to-keep","Evidence to keep",[92,1422,1423,1424,1427],{},"Export or screenshot the user list and MFA report. Date it. ",[151,1425,1426],{},"This is your baseline"," for next time. Store this user list securely as it contains personal information and details that could help a cyber criminal.",[136,1429,1431],{"id":1430},"step-2-money-paths-30-minutes","Step 2: Money paths - 30 minutes",[92,1433,1434],{},"Review your actual payment process and recent examples:",[105,1436,1437,1447,1469],{},[108,1438,1439,1442,1443,1446],{},[151,1440,1441],{},"How do suppliers change their bank details?"," If the answer is \"by email\", record it as a finding. ",[151,1444,1445],{},"Never accept new or changed payment details without confirming the request through a separate, trusted channel."," For example, call the supplier using a phone number you already have, not a phone number provided in the email.",[108,1448,1449,1452,1453,1456,1457,1460,1461,1464,1465,1468],{},[151,1450,1451],{},"Can one person create and approve payments alone?"," Where separation of duties is not practical, use several compensating controls: ",[151,1454,1455],{},"independent verification"," of new or changed payment details, ",[151,1458,1459],{},"bank transaction limits",", ",[151,1462,1463],{},"payment alerts"," and a ",[151,1466,1467],{},"regular review of payments"," by another owner, director or trusted adviser.",[108,1470,1471,1474],{},[151,1472,1473],{},"Does your banking show information about the recipient before you approve a payment?"," This may include an account-name check, PayID name or Confirmation of Payee result. Make sure whoever pays invoices understands the message,but does not use it as a substitute for independently confirming changed payment details.",[136,1476,1478],{"id":1477},"step-3-backups-and-cloud-systems-30-minutes","Step 3: Backups and cloud systems - 30 minutes",[105,1480,1481,1487,1493,1503],{},[108,1482,1483,1486],{},[151,1484,1485],{},"What is actually backed up?"," Name the systems and information your business could not operate without. Examples may include accounting and payroll records, client files, email, customer databases, contracts, website data, source code, project files, important system settings and more. Confirm that each one is included in the backup, not just \"the computer\".",[108,1488,1489,1492],{},[151,1490,1491],{},"Is one backup copy protected?"," A permanently connected drive or a synchronised folder like OneDrive or Google Drive should not be your only backup. Deleted, encrypted, damaged files or ransomware may be synchronised across devices. Check whether your service offers separate version history or recovery features.",[108,1494,1495,1498,1499,1502],{},[151,1496,1497],{},"Restore one real file now."," Pick any recent document from your backup, restore it and open it. ",[151,1500,1501],{},"This may be the highest-value ten minutes of the whole health check",". A backup that has never been tested is only an assumption. If the restore fails, you have discovered the problem before a real emergency.",[108,1504,1505,1508],{},[151,1506,1507],{},"Critical cloud systems."," List the online services your business relies on. Examples may include accounting, payroll, CRM, website hosting and document storage. Confirm who owns each account, who has administrator access, and what recovery or export options are available.",[136,1510,1512],{"id":1511},"step-4-devices-and-updates-30-minutes","Step 4: Devices and updates - 30 minutes",[105,1514,1515,1521,1527,1533,1539,1545],{},[108,1516,1517,1520],{},[151,1518,1519],{},"Is every work computer and phone supported and automatically updating?"," Check whether the operating system is still receiving updates, and whether automatic updates are on. Put anything that no longer receives security updates on the replacement list - it cannot be protected to the same standard as a supported device.",[108,1522,1523,1526],{},[151,1524,1525],{},"Are laptops encrypted?"," Check whether BitLocker on Windows or FileVault on Mac is turned on.",[108,1528,1529,1532],{},[151,1530,1531],{},"Is computer protection working?"," Check that antivirus or other built-in security protection is turned on and up to date.",[108,1534,1535,1538],{},[151,1536,1537],{},"Do devices lock automatically?"," Make sure computers and phones lock after a short period of inactivity and require a strong password, passcode, PIN or biometric sign-in.",[108,1540,1541,1544],{},[151,1542,1543],{},"Does each person have their own login?"," Ensure that staff do not share accounts and do not use an administrator account for everyday work.",[108,1546,1547,1550],{},[151,1548,1549],{},"Lost phones."," If a phone with company email went missing today, could you wipe it remotely? If you don't know, the answer is no.",[136,1552,1554],{"id":1553},"step-5-people-and-paper-30-minutes","Step 5: People and paper - 30 minutes",[105,1556,1557,1563,1576],{},[108,1558,1559,1562],{},[151,1560,1561],{},"Offboarding checklist."," Is there a written checklist removing a departing employee or contractor’s access to every business system? If not, create one using the user list from Step 1.",[108,1564,1565,1568,1569,1572,1573,1575],{},[151,1566,1567],{},"The two rules for staff."," Make sure everyone who works with email or payments knows these rules:",[1570,1571],"br",{},"\n1 - Never approve an MFA prompt you didn't request. Repeated unexpected prompts may mean that someone already has your password.",[1570,1574],{},"\n2 - Never change suppliers’ bank details based on an email alone. Confirm the changes by calling a trusted phone number you already have.",[108,1577,1578,1581,1582,1588],{},[151,1579,1580],{},"The incident card."," Print one page with your bank's fraud number, the Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371) - it’s available 24\u002F7, and the ",[627,1583,1587],{"href":1584,"rel":1585},"https:\u002F\u002Fwww.cyber.gov.au\u002Freport-and-recover\u002Fwhere-get-help",[1586],"nofollow","ReportCyber"," web address. Also include your cyber insurer and policy number, IT or incident-response provider, legal or privacy adviser, authorised decision-maker, domain registrar and website host. Keep this card somewhere accessible if your systems are unavailable.",[96,1590,1591],{},[92,1592,1593],{},"If you suspect an active incident, stop the health check and seek professional assistance. Do not delete files, messages or logs that may be evidence. Where safe to do so, disconnect an affected computer from Wi-Fi or the network without wiping or resetting it.",[136,1595,1597],{"id":1596},"step-6-official-checks-and-your-findings-20-minutes","Step 6: Official checks and your findings - 20 minutes",[92,1599,1600,1601,1606],{},"Finish with the Australian government’s free and anonymous ",[627,1602,1605],{"href":1603,"rel":1604},"https:\u002F\u002Fwww.cyber.gov.au\u002Fcyberhealthcheck",[1586],"Cyber Health Check Tool",". It takes about five minutes and provides simple, tailored suggestions that you can compare with your findings.",[96,1608,1609],{},[92,1610,1611,1612,1617],{},"For a deeper follow-up with your team, use the ACSC's free ",[627,1613,1616],{"href":1614,"rel":1615},"https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fexercise-in-a-box",[1586],"Exercise in a Box",".  It provides practical exercises to help you test how your business would respond to a cyber incident.",[92,1619,1620],{},"Turn your notes into an action plan. Use one row for each finding and four columns:",[211,1622,1623,1647],{},[214,1624,1625],{},[217,1626,1627,1632,1637,1642],{},[220,1628,1629],{},[151,1630,1631],{},"Finding",[220,1633,1634],{},[151,1635,1636],{},"Risk",[220,1638,1639],{},[151,1640,1641],{},"Fix",[220,1643,1644],{},[151,1645,1646],{},"Who \u002F by when",[231,1648,1649],{},[217,1650,1651,1654,1657,1660],{},[236,1652,1653],{},"2 staff accounts do not have MFA",[236,1655,1656],{},"A stolen password could allow someone to access business email",[236,1658,1659],{},"Enforce MFA",[236,1661,1662],{},"Me \u002F Friday",[92,1664,1665,1666,1669],{},"That simple table is the beginning of a practical ",[151,1667,1668],{},"cyber security risk register",". Over time, you can add the severity of the risk, status and date reviewed.",[92,1671,1672,1673,1676],{},"For most small businesses, repeating this ",[151,1674,1675],{},"check every three months"," is a practical starting point. Run it sooner after an employee departure, major system change or suspected incident.",[526,1678,1680],{"id":1679},"prioritise-your-findings-or-what-should-i-fix-first-after-the-health-check","Prioritise your findings, or what should I fix first after the health check?",[92,1682,1683],{},"Deal immediately with any sign of active compromise. Examples may include an unknown administrator, unexplained email forwarding rule, unfamiliar login or unauthorised payment.",[92,1685,1686],{},"For other findings, a practical starting order is:",[326,1688,1689,1692,1695,1698,1701,1704,1707],{},[108,1690,1691],{},"Protect administrator, email and financial accounts with MFA.",[108,1693,1694],{},"Disable former users who still have access.",[108,1696,1697],{},"Confirm that critical information can be restored from backup.",[108,1699,1700],{},"Strengthen payment verification and approval controls.",[108,1702,1703],{},"Update devices and software.",[108,1705,1706],{},"Replace unsupported devices and software.",[108,1708,1709],{},"Address the remaining findings according to their likely business impact.",[136,1711,1713],{"id":1712},"when-diy-isnt-enough","When DIY isn't enough",[92,1715,1716],{},"This health check can identify common security gaps, but it does not test your systems for technical weaknesses. Seek professional help if there’s a suspected cyber security incident, when important findings remain unfixed, when your business needs technical security testing, or when it holds sensitive or high-risk information such as health records, identity documents, TFNs or financial details.",[92,1718,1719],{},"Most Australian businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but important exceptions apply. For example, some health service providers, businesses that trade in personal information and certain Commonwealth contractors may be covered regardless of turnover.",[92,1721,1722,1723,1728],{},"Check the ",[627,1724,1727],{"href":1725,"rel":1726},"https:\u002F\u002Fwww.oaic.gov.au\u002Fprivacy\u002Fprivacy-guidance-for-organisations-and-government-agencies\u002Forganisations\u002Fsmall-business#section-privacy-checklist-for-small-business",[1586],"OAIC’s Small Business Privacy Checklist"," or obtain legal advice if you are unsure whether the Privacy Act applies to your business",[92,1730,1731,1732,1737],{},"When engaging a cyber security provider, ask what framework and assessment method they will use. Depending on your systems and risks, an ",[627,1733,1736],{"href":1734,"rel":1735},"https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fasds-cyber-security-frameworks\u002Fessential-eight",[1586],"Essential Eight"," assessment - often beginning with Maturity Level One - may provide a structured and comparable baseline.",[526,1739,1741],{"id":1740},"cant-spare-a-whole-afternoon","Can't spare a whole afternoon?",[92,1743,1744],{},"Do the ten-minute version:",[326,1746,1747,1750,1753],{},[108,1748,1749],{},"Check that MFA protects the owner's email account.",[108,1751,1752],{},"Explain the payment-verification rule to anyone who pays invoices.",[108,1754,1755],{},"Restore one file from backup.",[1757,1758],"hr",{},[92,1760,1761],{},[1762,1763,1764,1765,1768,1769,401],"em",{},"This article is part of our ",[627,1766,1767],{"href":31},"cyber security for small businesses"," series - including ",[627,1770,1772],{"href":1771},"\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms","why hackers target accounting firms",[1757,1774],{},[136,1776,634],{"id":633},[105,1778,1779,1782,1785,1788,1791,1794,1797,1800,1803,1806,1809,1812],{},[108,1780,1781],{},"ASD’s ACSC, Cyber Health Check Tool",[108,1783,1784],{},"ASD’s ACSC, Small Business Cyber Security Guide",[108,1786,1787],{},"ASD’s ACSC, Small Business Hub",[108,1789,1790],{},"ASD’s ACSC, Preventing Business Email Compromise",[108,1792,1793],{},"ASD’s ACSC, Review Your Email Account Security",[108,1795,1796],{},"ASD’s ACSC, Exercise in a Box",[108,1798,1799],{},"ASD’s ACSC, Essential Eight",[108,1801,1802],{},"ASD’s ACSC, Cybercrime - getting help",[108,1804,1805],{},"business.gov.au, Cyber Security Checklist",[108,1807,1808],{},"OAIC, Small Business and the Privacy Act",[108,1810,1811],{},"Microsoft Learn, relevant current MFA administration guidance",[108,1813,1814],{},"Google Workspace Admin Help, relevant 2-Step Verification guidance",{"title":25,"searchDepth":680,"depth":680,"links":1816},[1817,1820,1821,1822,1823,1824,1827,1830],{"id":1335,"depth":680,"text":1336,"children":1818},[1819],{"id":1419,"depth":692,"text":1420},{"id":1430,"depth":680,"text":1431},{"id":1477,"depth":680,"text":1478},{"id":1511,"depth":680,"text":1512},{"id":1553,"depth":680,"text":1554},{"id":1596,"depth":680,"text":1597,"children":1825},[1826],{"id":1679,"depth":692,"text":1680},{"id":1712,"depth":680,"text":1713,"children":1828},[1829],{"id":1740,"depth":692,"text":1741},{"id":633,"depth":680,"text":634},"\u002Fcovers\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check.jpg","A practical, jargon-free cyber security checklist you can complete this afternoon to see where your business is exposed - no IT department required.",[1834,1837,1840,1843,1846,1849],{"question":1835,"answer":1836},"Can a small business complete a cyber security health check without an IT provider?","Yes. A business owner or manager can check common risks, including inactive accounts, missing MFA, untested backups, unsupported devices and unsafe payment processes. Please note that a DIY review does not test networks, applications or systems for technical vulnerabilities.",{"question":1838,"answer":1839},"Do I need an IT background to run a cyber security health check?","No. You need admin access to your Microsoft 365 or Google Workspace, your backup system login, and a notepad. Follow the cyber security checklist steps and write down your findings to act on them later.",{"question":1841,"answer":1842},"Is OneDrive or Google Drive a backup?","File synchronisation may help recover earlier files, but a synchronised folder should not be your business’ only backup. Deletions, damaged files or ransomware may be synchronised across devices. Keep a separate protected backup and regularly test that you can restore files from it.",{"question":1844,"answer":1845},"How often should a small business run a cyber security health check?","Every three months is a practical starting point. Run the check sooner if there is a major change, such as a staff departure, the introduction of new software, a change of IT provider or a suspected cyber security incident.",{"question":1847,"answer":1848},"Is there a free government cyber security assessment for small businesses?","Yes. The Cyber Health Check Tool on cyber.gov.au is free and anonymous. It provides tailored suggestions based on your answers. The ACSC's free Exercise in a Box can help your team practice responding to realistic cyber incident scenarios.",{"question":1850,"answer":1851},"When should a business get professional cyber security help?","Seek professional help after a suspected cyber security incident, when important security issues remain unresolved, when a technical testing is required, or when your business holds sensitive or high-risk information, such as health records, identity documents, tax file numbers or financial details. Most Australian small businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but important exceptions apply. Obtain privacy or legal advice if you are unsure whether the Privacy Act applies to your business.",{},{"description":1854,"title":1855},"A plain-English cyber security checklist Australian small businesses can complete themselves, with practical steps and no IT department required.","DIY Cyber Security Health Check for Small Business","Reviewed against current guidance from ASD’s Australian Cyber Security Centre, business.gov.au, the OAIC, Microsoft and Google",{"title":1305,"description":1832},{"loc":37},"cyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check",[48,1861],"Small Business","Nhqi3lLVSDN8wAzFS-1zxT1E-fupXjMiRnQ7gSAcOXw",{"id":1864,"title":1865,"authorBio":1866,"body":1867,"coverImage":2340,"date":698,"description":2341,"extension":700,"faq":2342,"heroImage":2340,"lastReviewed":702,"meta":2355,"metadata":2356,"navigation":706,"path":1771,"readingTime":2358,"reviewedAgainst":2359,"seo":2360,"sitemap":2361,"stem":2362,"summary":2363,"tags":2364,"thumbnail":2340,"__hash__":2365},"blog\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms.md","Why Hackers Target Accounting Firms and How to Reduce the Risk","Written by Elena Osipova, CPA and emerging cyber security practitioner. Drawing on her accounting and business experience, Elena writes about cyber security governance, real-world incidents and practical security controls for Australian small businesses.",{"type":89,"value":1868,"toc":2328},[1869,1872,1875,1878,1881,1884,1888,1891,1936,1939,1942,1945,1949,1952,1955,1964,1968,1971,1991,1994,1998,2001,2005,2008,2040,2044,2047,2182,2186,2192,2198,2204,2210,2215,2219,2276,2279,2281],[92,1870,1871],{},"In May 2025, the Qilin ransomware group listed Melbourne accounting practice MKA Accountants on its darknet leak site. The group published 12 sample documents it claimed were taken from the firm, including financial statements, insurance information and internal correspondence.",[92,1873,1874],{},"MKA Accountants confirmed that it was investigating unauthorised access and had notified clients and relevant authorities, including the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC). Later reports said Qilin claimed to have released more than 185GB of data, although the exact volume was not independently confirmed.",[92,1876,1877],{},"In May 2026, Brisbane accounting firm Kennedy McLaughlin & Associates confirmed unauthorised access to part of its IT environment after the same ransomware group listed it on their darknet leak site. Cyber Daily reported that a dataset containing client financial details and banking information appeared to have been published. The firm said it had notified affected individuals, the ACSC and the OAIC about this incident.",[92,1879,1880],{},"These were not large organisations. They were local accounting practices - the kind of businesses that hold tax and financial records, payroll and identity document information for many clients.",[92,1882,1883],{},"That set of valuable information is exactly what makes accounting firms attractive targets to cyber criminals.",[136,1885,1887],{"id":1886},"why-accounting-firms-are-valuable-targets","Why accounting firms are valuable targets",[92,1889,1890],{},"Cybercriminals may target an accounting firm for money, but the greater attraction is often the client information and trusted access the firm holds for every client, going back years. This may include:",[105,1892,1893,1898,1903,1908,1914,1920,1925,1930],{},[108,1894,1895],{},[151,1896,1897],{},"Tax file numbers",[108,1899,1900],{},[151,1901,1902],{},"Bank account details",[108,1904,1905],{},[151,1906,1907],{},"Financial statements",[108,1909,1910,1913],{},[151,1911,1912],{},"Payroll data"," such as clients’ employee names, addresses, salaries, bank and superannuation details",[108,1915,1916,1919],{},[151,1917,1918],{},"Identity documents information"," collected for verification",[108,1921,1922],{},[151,1923,1924],{},"Director ID numbers",[108,1926,1927],{},[151,1928,1929],{},"Trust, company and superannuation fund account details",[108,1931,1932,1935],{},[151,1933,1934],{},"Tax and lodgement access information"," like practice-management software, online services for agents, myID-linked access and authorisations that allow staff to act for their clients.",[92,1937,1938],{},"Together, these records can provide enough information for identity theft, tax fraud, and various elaborate, targeted scams.",[92,1940,1941],{},"Accounting and professional service firms are regularly affected by reportable data breaches. In 2025, the OAIC received 1,205 data breach notifications. Legal, accounting and management services accounted for 81 notifications, or approximately 6.7% of the total. This placed the combined sector among the five highest by notification volume.",[92,1943,1944],{},"The information held by accountants for their clients can be used for identity crime, refund fraud and highly convincing scams.",[136,1946,1948],{"id":1947},"what-information-attackers-want","What information attackers want",[92,1950,1951],{},"A stolen TFN isn't just sold once - it's put to work. Cybercriminals have used stolen identities to create fake myGov accounts, link them to real taxpayers' ATO records, then lodge fraudulent tax returns and activity statements and redirect the refunds.",[92,1953,1954],{},"In the two years to February 2023, the ATO cancelled more than 37,000 fraudulent tax returns and business activity statements with a claimed value of $557.8 million. This affected more than 15,000 taxpayers. Some claims were stopped before payment, and the ATO could not attribute the entire amount of claims to a single fraud method.",[92,1956,1957,1958,1963],{},"In February 2024, the ATO said it was defending its websites, services and infrastructure against an average of 4.7 million attempted cyber attacks each month. The ATO maintains the dedicated ",[627,1959,1962],{"href":1960,"rel":1961},"https:\u002F\u002Fwww.ato.gov.au\u002Fonline-services\u002Fscams-cyber-safety-and-identity-protection\u002Fhelp-with-data-breaches\u002Fdata-breach-guidance-for-tax-professionals",[1586],"data breach guidance for tax professionals"," so firms can report incidents quickly when client identities, tax information or agent access may have been compromised.",[136,1965,1967],{"id":1966},"how-cyber-attacks-commonly-happen","How cyber attacks commonly happen",[92,1969,1970],{},"Three common attack paths show how a cyber incident may unfold:",[326,1972,1973,1979,1985],{},[108,1974,1975,1978],{},[151,1976,1977],{},"Phishing and email takeover."," An employee receives a convincing email prompting them to enter their username and password on a fake but look-alike Microsoft 365 login page. The attacker gets the access and reads the mailbox for weeks, downloads client records, and uses the trusted address to send invoice-redirection emails to clients.",[108,1980,1981,1984],{},[151,1982,1983],{},"Ransomware with data theft."," An attacker gains access, quietly copies information, may then encrypt systems before threatening to publish the stolen data. The MKA Accountants and Kennedy McLaughlin & Associates incidents were publicly associated with this type of attack. Paying a ransom does not guarantee that stolen data will be deleted or kept private.",[108,1986,1987,1990],{},[151,1988,1989],{},"Credential theft against practice software and portals."," Stolen logins for practice management systems or lodgement services give cybercriminals the same reach the practice has - across every client at once.",[92,1992,1993],{},"Highly sophisticated hacking is not always required. Many incidents begin with a stolen password, a phishing message, an unpatched system or access that should have been removed.",[136,1995,1997],{"id":1996},"what-a-breach-can-cost","What a breach can cost",[92,1999,2000],{},"In 2024-25, the average self-reported financial loss per cybercrime report from a small business was approximately $56,600, 14% higher than the previous year.",[136,2002,2004],{"id":2003},"legal-and-professional-obligations","Legal and professional obligations",[92,2006,2007],{},"For an accounting practice, stolen money and ransomware demands are only the beginning. A data breach triggers a stack of obligations that most other small businesses never face. These may include:",[105,2009,2010,2016,2022,2028,2034],{},[108,2011,2012,2015],{},[151,2013,2014],{},"Privacy Act and Notifiable Data Breaches scheme."," Many small accounting practices are TFN recipients and may have Privacy Act obligations for the TFN information they hold, even when annual turnover is $3 million or less. They must notify the OAIC and affected individuals when the breach meets the legal test for an eligible data breach, including that it is likely to cause serious harm.",[108,2017,2018,2021],{},[151,2019,2020],{},"Tax Practitioners Board."," Registered tax practitioners must report a significant breach of the Code of Professional Conduct to the TPB within 30 days of when they know, or ought to know that the breach occurred. A cyber incident may trigger this obligation if it involves a significant breach of duties such as client confidentiality or causes, or is likely to cause material loss or damage. Whether reporting is required depends on the circumstances.",[108,2023,2024,2027],{},[151,2025,2026],{},"ATO notification."," Where client identities, TFNs, tax records or agent access may have been compromised, accounting firms should promptly contact the ATO, so it can assess and apply appropriate protections.",[108,2029,2030,2033],{},[151,2031,2032],{},"Professional standards."," Members of professional accounting bodies, such as CPA Australia, may also have confidentiality obligations under APES 110, the Code of Ethics for Professional Accountants. Registered tax practitioners have separate confidentiality obligations under the TPB Code of Professional Conduct. A failure to take reasonable safeguards may also raise professional and ethical issues, depending on the circumstances.",[108,2035,2036,2039],{},[151,2037,2038],{},"Reputational damage and client attrition."," Clients trust their accountants with everything. A public data leak can cause lasting damage to client trust and the firm’s reputation.",[136,2041,2043],{"id":2042},"controls-that-reduce-the-risk","Controls that reduce the risk",[92,2045,2046],{},"The following controls help reduce the risks discussed above. And most of them are low effort.",[211,2048,2049,2068],{},[214,2050,2051],{},[217,2052,2053,2058,2063],{},[220,2054,2055],{},[151,2056,2057],{},"Control",[220,2059,2060],{},[151,2061,2062],{},"Risk it reduces",[220,2064,2065],{},[151,2066,2067],{},"Effort",[231,2069,2070,2081,2091,2102,2112,2122,2132,2142,2152,2162,2172],{},[217,2071,2072,2075,2078],{},[236,2073,2074],{},"MFA on email, practice software and tax-related accounts",[236,2076,2077],{},"Account takeover after password theft",[236,2079,2080],{},"Low",[217,2082,2083,2086,2089],{},[236,2084,2085],{},"Password manager and strong, unique passwords",[236,2087,2088],{},"Password reuse and credential-stuffing attacks",[236,2090,2080],{},[217,2092,2093,2096,2099],{},[236,2094,2095],{},"Protected backup copy",[236,2097,2098],{},"Loss of all recoverable copies during ransomware",[236,2100,2101],{},"Medium",[217,2103,2104,2107,2110],{},[236,2105,2106],{},"Segregation of payment duties and independent verification of changed payment details",[236,2108,2109],{},"Invoice and payment-redirection fraud",[236,2111,2080],{},[217,2113,2114,2117,2120],{},[236,2115,2116],{},"Practical staff training on phishing, unexpected MFA prompts and payment changes",[236,2118,2119],{},"Staff responding to phishing, unexpected MFA prompts and approving fake payment requests",[236,2121,2080],{},[217,2123,2124,2127,2130],{},[236,2125,2126],{},"Automatic security updates on operating systems and practice software",[236,2128,2129],{},"Exploitation of known vulnerabilities in unpatched software",[236,2131,2080],{},[217,2133,2134,2137,2140],{},[236,2135,2136],{},"Regular access reviews and offboarding checklist for staff",[236,2138,2139],{},"Unnecessary access and active former-staff access",[236,2141,2080],{},[217,2143,2144,2147,2150],{},[236,2145,2146],{},"Regular review of third-party, contractor and connected-app access",[236,2148,2149],{},"Unnecessary access by old providers, contractors or connected apps",[236,2151,2101],{},[217,2153,2154,2157,2160],{},[236,2155,2156],{},"Sign-in and administrator alerts",[236,2158,2159],{},"Undetected misuse of compromised accounts",[236,2161,2101],{},[217,2163,2164,2167,2170],{},[236,2165,2166],{},"Data retention and secure deletion",[236,2168,2169],{},"Unnecessary exposure of old client records and identity documents",[236,2171,2101],{},[217,2173,2174,2177,2180],{},[236,2175,2176],{},"Tested incident-response plan",[236,2178,2179],{},"Delayed containment and missed reporting steps",[236,2181,2101],{},[526,2183,2185],{"id":2184},"four-controls-worth-a-closer-look","Four controls worth a closer look",[92,2187,2188,2191],{},[151,2189,2190],{},"Review what you keep."," Retain records for the periods required by law and professional standards, but securely delete duplicate files, outdated identity documents and other information when there is no longer legal, professional or business reason to keep it. Holding less unnecessary information reduces the potential impact of a breach.",[92,2193,2194,2197],{},[151,2195,2196],{},"Review connected services."," Check which cloud platforms, software integrations, contractors and service providers can access client information. Remove unused and unnecessary connections, confirm who has administrator access and understand how each provider protects and backs up your data.",[92,2199,2200,2203],{},[151,2201,2202],{},"Train staff on real warning signs."," Make sure employees know how to recognise suspicious login pages, unexpected MFA prompts and urgent payment requests. They should know who to contact and what to do before clicking, approving a prompt or making a payment.",[92,2205,2206,2209],{},[151,2207,2208],{},"Protect at least one backup copy."," Keep one backup offline, immutable or otherwise protected from normal user accounts and devices. Test regularly that important files can be restored from it.",[92,2211,625,2212,2214],{},[627,2213,629],{"href":37}," for a structured review of your accounts, payments, backups, devices and business processes.",[136,2216,2218],{"id":2217},"five-actions-to-take-this-week","Five actions to take this week",[326,2220,2221,2227,2246,2252,2258],{},[108,2222,2223,2226],{},[151,2224,2225],{},"Turn on MFA"," for every supported business account, beginning with email, administrator, financial and tax-related accounts. Where available, use phishing-resistant methods like passkeys or security keys.",[108,2228,2229,2232],{},[151,2230,2231],{},"Give staff two clear rules:",[326,2233,2234,2240],{},[108,2235,2236,2239],{},[151,2237,2238],{},"Never approve an MFA prompt they did not request",". An unexpected prompt may mean someone is trying to access the account.",[108,2241,2242,2245],{},[151,2243,2244],{},"Never change payment details based on an email alone",". Confirm the request by calling a trusted phone number already held by the firm.",[108,2247,2248,2251],{},[151,2249,2250],{},"Enable automatic security updates where supported."," Keep computers, servers, browsers, practice software, remote access tools and internet-facing devices protected against known vulnerabilities.",[108,2253,2254,2257],{},[151,2255,2256],{},"Review your user list."," Check every account and access role. Promptly disable accounts belonging to former staff. Treat any unknown or suspicious account as urgent.",[108,2259,2260,2263,2264,2267,2268,2271,2272,2275],{},[151,2261,2262],{},"Print your incident contacts."," Include the ATO's ",[627,2265,1962],{"href":1960,"rel":2266},[1586],", the OAIC, the TPB, ",[627,2269,1587],{"href":1584,"rel":2270},[1586]," and the Australian Cyber Security Hotline ",[151,2273,2274],{},"1300 CYBER1 (1300 292 371)",". You should also include your IT or incident-response provider; cyber insurer and policy number; legal or privacy adviser; authorised decision-maker.",[92,2277,2278],{},"Cybercriminals target accounting firms because the information and access they hold can be highly valuable. The good news is that you can strengthen your defences  with basic, consistent controls to make many common attack paths much harder.",[136,2280,634],{"id":633},[105,2282,2283,2286,2289,2292,2295,2298,2301,2304,2307,2310,2313,2316,2319,2322,2325],{},[108,2284,2285],{},"ASD, Annual Cyber Threat Report 2024-25",[108,2287,2288],{},"OAIC, Data breach notifications increase to all-time high in 2025",[108,2290,2291],{},"OAIC, Quick reference guide for responding to data breaches",[108,2293,2294],{},"OAIC, The Privacy (Tax File Number) Rule 2015 and the protection of TFN information",[108,2296,2297],{},"ATO, Agent checklist for client-to-agent linking process",[108,2299,2300],{},"ATO, Accessing Online services for agents",[108,2302,2303],{},"ATO, Data breach guidance for tax professionals",[108,2305,2306],{},"Australian Government, Privacy (Tax File Number) Rule 2015",[108,2308,2309],{},"TPB, Breach reporting obligations;",[108,2311,2312],{},"TPB, Protect your practice from cyber-attacks",[108,2314,2315],{},"TPB, Debunking myths about breach reporting",[108,2317,2318],{},"iTnews, ATO attackers filed $557 million in false claims",[108,2320,2321],{},"Cyber Daily, MKA Accountants confirms Qilin ransomware attack",[108,2323,2324],{},"Cyber Daily, Kennedy McLaughlin confirms cyber incident",[108,2326,2327],{},"ABC, Outgoing ATO boss says getting rid of work-related tax deductions would be a 'big step'",{"title":25,"searchDepth":680,"depth":680,"links":2329},[2330,2331,2332,2333,2334,2335,2338,2339],{"id":1886,"depth":680,"text":1887},{"id":1947,"depth":680,"text":1948},{"id":1966,"depth":680,"text":1967},{"id":1996,"depth":680,"text":1997},{"id":2003,"depth":680,"text":2004},{"id":2042,"depth":680,"text":2043,"children":2336},[2337],{"id":2184,"depth":692,"text":2185},{"id":2217,"depth":680,"text":2218},{"id":633,"depth":680,"text":634},"\u002Fcovers\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms.jpg","Learn why accounting firms attract cybercriminals and the practical steps small practices can take to protect client data and reduce cyber risk.",[2343,2346,2349,2352],{"question":2344,"answer":2345},"Why would hackers target a small accounting firm instead of a big company","A small accounting firm may hold the same kinds of valuable client information as a big company, including TFNs, payroll records, bank details and identity documents. At the same time, smaller firms may have fewer dedicated IT and security resources. This combination can make them attractive to cybercriminals.",{"question":2347,"answer":2348},"Does the Privacy Act apply to my accounting practice if turnover is under $3 million?","Under the Privacy (Tax File Number) Rule 2015, many accounting practices with annual turnover of $3 million or less still have Privacy Act obligations because they receive and hold TFN information. If a breach is likely to cause serious harm, the practice may need to notify the OAIC and affected individuals under the Notifiable Data Breaches scheme. Other Privacy Act exceptions may also apply. Obtain legal or privacy advice for your circumstances.",{"question":2350,"answer":2351},"What is the single most effective protection for an accounting firm?","Multi-factor authentication (MFA) is one of the most important protections for administrator, email, practice management software and tax-related accounts. It adds another layer of protection when a password is stolen or phished.",{"question":2353,"answer":2354},"What should an accounting firm do immediately after discovering a data breach?","Where safe and appropriate, disconnect an affected computer from Wi-Fi or the network without wiping or resetting it, and seek qualified IT or incident-response support. Contact the ATO promptly if client tax information or agent access may be affected. The firm should then assess its notification obligations. These may include notifying the OAIC and affected individuals under the Notifiable Data Breaches scheme, the TPB where a significant Code of Professional Conduct breach may have occurred; professional associations, insurers, and other affected parties",{},{"description":2341,"title":2357},"Why Hackers Target Accounting Firms & How to Reduce the Risk",9,"Reviewed against current guidance from ASD’s Australian Cyber Security Centre, the OAIC, business.gov.au, the ATO and TPB",{"title":1865,"description":2341},{"loc":1771},"cyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms","Accounting firms hold the keys to their clients' finances - which is exactly why they're such an attractive target for cybercriminals. Here's what makes them vulnerable, and how to close the cyber security gaps.",[48,1861],"JKrfW2SpuQSHKmIm97ylyA-qvnCXZppsJchpqGZpN5c",1785205145770]