[{"data":1,"prerenderedAt":3097},["ShallowReactive",2],{"navigation":3,"socials":68,"post-\u002Freact-js-development-services":83,"post-related":832},{"id":4,"extension":5,"footer":6,"header":56,"meta":65,"stem":66,"__hash__":67},"navigation\u002Fnavigation.yml","yml",[7,26,38],{"label":8,"items":9,"path":25},"Web development",[10,13,16,19,22],{"label":11,"path":12},"Vue web development","\u002Fvue-js-development-services",{"label":14,"path":15},"React development services","\u002Freact-js-development-services",{"label":17,"path":18},"Laravel development services","\u002Flaravel-development-services",{"label":20,"path":21},"Shopify developers Melbourne","\u002Fshopify",{"label":23,"path":24},"Next.js developers Melbourne","\u002Fnext-js-framework","",{"label":27,"items":28,"path":25},"Cyber security",[29,32,35],{"label":30,"path":31},"Cyber security for small business","\u002Fcyber-security\u002Fsmall-business",{"label":33,"path":34},"Lessons from famous breaches","\u002Fcyber-security\u002Fbreach-lessons",{"label":36,"path":37},"Free cyber health check","\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check",{"label":39,"items":40},"Navigate",[41,44,47,50,53],{"label":42,"path":43},"Home","\u002F",{"label":45,"path":46},"Case Studies","\u002Fcase-studies",{"label":48,"path":49},"Cyber Security","\u002Fcyber-security",{"label":51,"path":52},"Contact Us","\u002Fcontact",{"label":54,"path":55},"Editorial Policy","\u002Feditorial-policy",[57,60,61,62],{"label":58,"path":59},"Web Development","\u002Fweb-development",{"label":45,"path":46},{"label":48,"path":49},{"label":63,"path":64},"About","\u002Fabout",{},"navigation","vaEm85Hrq3ctMNbTgmkywbdLEBklhE1-5zsuR9ZI5Oo",{"id":69,"extension":5,"items":70,"meta":80,"stem":81,"__hash__":82},"socials\u002Fsocials.yml",[71,74,77],{"type":72,"link":73},"facebook","https:\u002F\u002Fwww.facebook.com\u002Fitclub.com.au",{"type":75,"link":76},"linkedin","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fitclub\u002Fabout\u002F",{"type":78,"link":79},"behance","https:\u002F\u002Fwww.behance.net\u002Felenaitclub\u002F",{},"socials","R3zh7G2Yeky6IFraIEG2izmfHXa3EG7r0rHl4YbjpWk",{"id":84,"title":85,"authorBio":86,"body":87,"coverImage":785,"date":786,"description":787,"extension":788,"faq":789,"heroImage":86,"lastReviewed":86,"meta":820,"metadata":821,"navigation":822,"path":15,"readingTime":86,"reviewedAgainst":86,"seo":823,"sitemap":824,"stem":825,"summary":826,"tags":827,"thumbnail":785,"__hash__":831},"blog\u002Fweb-development\u002Freact-js-development-services.md","React Development Services",null,{"type":88,"value":89,"toc":753},"minimark",[90,94,97,138,142,152,159,162,177,192,202,205,232,235,246,252,258,266,269,272,321,324,332,337,344,348,351,355,358,362,368,372,375,378,382,390,394,397,401,406,410,418,425,432,439,441,444,447,450,453,461,465,468,471,479,488,492,495,499,502,505,514,518,521,524,528,537,544,551,554,560,563,566,578,580,584,591,594,620,625,631,633,636,647,650,653,676,679,683,686,690,693,697,700,704,715,722,728,730,739,749,751],[91,92,93],"p",{},"If you want to get your web development off on the right foot, and not feel overwhelmed by the number of frameworks available, look no further. In this article, we explain why React is one of the best choices you can consider for your web app development.",[91,95,96],{},"Feel free to navigate to any item in the list by hitting their respective links below:",[98,99,100,108,114,120,126,132],"ul",{},[101,102,103],"li",{},[104,105,107],"a",{"href":106},"#what-is-react-web-development","What is React web development?",[101,109,110],{},[104,111,113],{"href":112},"#what-is-react-js-used-for","What is React js used for?",[101,115,116],{},[104,117,119],{"href":118},"#why-is-react-good","Why is React good?",[101,121,122],{},[104,123,125],{"href":124},"#react-development-company--react-services-we-offer","React development company & React services we offer",[101,127,128],{},[104,129,131],{"href":130},"#additional-react-related-services","Additional React-related services",[101,133,134],{},[104,135,137],{"href":136},"#react-development-expertise-you-get-working-with-us","React development expertise you get working with us",[139,140,107],"h2",{"id":141},"what-is-react-web-development",[91,143,144,145,151],{},"React development is when ",[104,146,150],{"href":147,"rel":148},"https:\u002F\u002Freactjs.org\u002F",[149],"nofollow","React.js"," is used for web or mobile development of a project.",[91,153,154,158],{},[155,156,157],"strong",{},"React"," is a flexible JavaScript library for creating responsive and engaging user interfaces. As one of the best front-end tools, it has an architecture based on components, which means that React developers can reuse code and create component libraries.",[91,160,161],{},"When companies decide to use React js for web development, this decision helps save a considerable amount of time and money on web development.",[163,164,165],"blockquote",{},[91,166,167,168,171,172],{},"“Write once. Use anywhere.”",[169,170],"br",{}," > ",[104,173,176],{"href":174,"rel":175},"https:\u002F\u002Ftwitter.com\u002Freactjs?lang=en",[149],"@reactjs",[91,178,179,180,185,186,191],{},"According to the Stack Overflow 2019 ",[104,181,184],{"href":182,"rel":183},"https:\u002F\u002Finsights.stackoverflow.com\u002Fsurvey\u002F2019#technology-_-most-loved-dreaded-and-wanted-web-frameworks",[149],"survey",", React and ",[104,187,190],{"href":188,"rel":189},"https:\u002F\u002Fitclub.com.au\u002Fvue-js-development-services",[149],"Vue"," are the most loved and wanted web frameworks.",[91,193,194,199,200],{},[195,196],"img",{"alt":197,"src":198,"title":197},"frontpagemetrics.com Metrics for Reddit Reactjs metrics Comparison React Vue Angular and Angular 2","\u002Fuploads\u002FReact_Vue_the_most_loved_wanted_web_frameworks.jpg"," ",[169,201],{},[91,203,204],{},"This is not surprising at all.",[91,206,207,208,211,212,215,216,219,220,223,224,227,228,231],{},"React gives your application ",[155,209,210],{},"versatility",", ",[155,213,214],{},"high performance",", and ",[155,217,218],{},"speed",". With ",[155,221,222],{},"small size",", well-developed ",[155,225,226],{},"documentation",", a huge React developer ",[155,229,230],{},"community",", and the backing of some of the biggest tech companies in the world, React has been in great demand in both web and mobile development.",[139,233,113],{"id":234},"what-is-react-js-used-for",[91,236,237,240,241,245],{},[155,238,239],{},"Front-end development with React",". React is a declarative, component-based, open-source JavaScript library for building user interfaces (front-end). Being independent of the rest of your tech stack, React can be used for front-end development, or for mobile applications written with the ",[104,242,244],{"href":243},"#mobile-apps-for-ios-and-android-using-react-js","React Native"," framework.",[91,247,248,251],{},[155,249,250],{},"React is suitable for both small websites and large web applications",". It excels in displaying data that changes over time, without the user having to refresh the website. React handles only the user interface part of applications, which would classify it as the View in Model-View-Controller architecture. While React can function perfectly as a standalone library, it can also be used together with other front-end JavaScript libraries and frameworks, such as AngularJS.",[91,253,254,257],{},[155,255,256],{},"React can be seen as a stable, time-proven and a cutting-edge library"," which is continuously evolving. It has been the main competitor of Google's AngularJS (v1.x and v2.x) since its beginnings, and React is now one of the most loved front-end frameworks.",[91,259,260,199,264],{},[195,261],{"alt":262,"src":263,"title":262},"Stack Overflow 2019 survey React and Vue are the most loved and wanted web frameworks","\u002Fuploads\u002FReact_Vue_Angular_metrics_comparison.jpg",[169,265],{},[139,267,119],{"id":268},"why-is-react-good",[91,270,271],{},"Here are some reasons why React js is so popular:",[98,273,274,281,288,295,314],{},[101,275,276,277,280],{},"React's ",[155,278,279],{},"declarative programming style"," allows web developers to control the flow and state in a React application, and not get bogged down in the implementation details of representing the state. Also, being able to describe the state dramatically reduces the surface area for bugs. A great benefit, isn't it?",[101,282,283,284,287],{},"While a React app is an SPA (Single Page Application) and, to be honest, not really SEO friendly, it can be turned into an ",[155,285,286],{},"SEO friendly app"," by using one of the following options. One is to use the Next.js framework. It provides you with a number of possibilities to make your app search engine friendly, like Server Side Rendering, Static Site Generation, or a combination of both. This allows web crawlers to see, read and index your pages, bringing organic traffic to your site and making your business more visible to your potential customers.",[101,289,290,291,294],{},"React developers can reuse ",[155,292,293],{},"components",", which increases the speed of the development and testing processes.",[101,296,297,298,301,302,307,308,313],{},"Thanks to ",[155,299,300],{},"powerful tools"," like ",[104,303,306],{"href":304,"rel":305},"https:\u002F\u002Fgithub.com\u002Ffacebook\u002Fcreate-react-app",[149],"React Create App",", Next.js, Gatsby, ",[104,309,312],{"href":310,"rel":311},"https:\u002F\u002Fgaearon.github.io\u002Freact-hot-loader\u002Fgetstarted\u002F",[149],"React Hot Loader"," and many others, the development process has become more straightforward and allows web developers to focus on writing code rather than spending time setting up the development environment.",[101,315,316,317,320],{},"The ",[155,318,319],{},"React developer tools"," Chrome extension allows web developers to debug your application and build bug-free code.",[91,322,323],{},"This is not all of the React advantages. Keep reading.",[91,325,326,199,330],{},[195,327],{"alt":328,"src":329,"title":328},"React Vue Angular Google Trends comparison Worldwide search","\u002Fuploads\u002FReact_Vue_Angular_google_trends_comparison.jpg",[169,331],{},[333,334,336],"h3",{"id":335},"react-for-efficient-and-interactive-web-apps","React for efficient and interactive web apps",[91,338,339,340,343],{},"If your project offers a lot of interactions with the end-user, React.js can be your preferred framework. This is because React helps resolve many of the challenges that come with developing efficient web applications. React introduces a virtual DOM that updates the real DOM in a smart and extremely efficient way, so even ",[155,341,342],{},"complex web applications can show great interactivity, without sacrificing their performance",".",[333,345,347],{"id":346},"react-creates-lightning-fast-user-interfaces","React creates lightning-fast user interfaces",[91,349,350],{},"React lets web developers build lightning-fast user interfaces, making great web applications for your customers\u002Fusers. This reactivity has made React very popular, and it is one of the main reasons why React development services for frontend are in such great demand these days.",[333,352,354],{"id":353},"great-productivity-in-react-front-end-development","Great productivity in React front-end development",[91,356,357],{},"Skilled React developers can reuse React components within your project whenever applicable, significantly increasing the speed of the project development. Over time, as the project continues, your React reusable components library increases, benefitting the project development speed further.",[333,359,361],{"id":360},"turn-a-react-app-into-a-mobile-app","Turn a React app into a mobile app",[91,363,364,365,367],{},"React can be used beyond the web. It is all possible with ",[104,366,244],{"href":243},", which allows using React’s benefits in mobile app development. Our React developers can easily share a large part of the codebase between a React-based web app and a React Native-based app for Android and iOS, and this can all be done without compromising the app’s performance.",[333,369,371],{"id":370},"react-is-excellent-for-scalable-web-apps","React is excellent for scalable web apps",[91,373,374],{},"Since the framework's release in 2013, React developers have changed their perception that React is suitable only for massive applications with tons of traffic. This is because the framework has seen many incremental improvements. Also, the emergence of a great variety of third-party development tools (e.g. Redux for state management), as well as the growth of the vibrant React developer community, help to quickly find an effective solution for any challenge that React developers may face.",[91,376,377],{},"For your project, this means that our experienced team can provide you with React js web application development services and help you create a scalable React app very quickly.",[333,379,381],{"id":380},"react-architecture","React Architecture",[91,383,384,385,389],{},"React Architecture applies beyond just HTML rendering, as it supports rendering to ",[386,387,388],"code",{},"\u003Ccanvas>"," tags, and can be suitable for isomorphic architecture, where the application logic runs on both the server and the client (browser) sides. This allows for several optimisations and, although it is not widely adopted, is certainly worth considering.",[333,391,393],{"id":392},"react-virtual-dom","React Virtual DOM",[91,395,396],{},"React developers no longer need to manually figure out the differences in the HTML code that should be rendered, nor do they have to update specific parts of the web page manually. This is because React's Virtual DOM enables the React developer to write the code as if the webpage was reloaded with every update, and React will automatically figure out the differences and update the view accordingly.",[333,398,400],{"id":399},"react-js-one-way-data-flow","React js one-way data flow",[91,402,403,404,343],{},"To keep code clean, React does not allow for component renderers to mutate any values that can be passed into it. Instead, any callbacks can be passed to components that modify values. This ensures that rendering and data mutation logic are separated, which provides great reusability for the code. Also, this \"data down, actions up\" approach combines perfectly with Redux, a state management library for React, which can work with both React and ",[104,405,244],{"href":243},[333,407,409],{"id":408},"react-hooks-a-new-feature-in-react-168","React Hooks, a new feature in React 16.8",[91,411,412,417],{},[104,413,416],{"href":414,"rel":415},"https:\u002F\u002Freactjs.org\u002Fdocs\u002Fhooks-intro.html",[149],"React Hooks",", a new React feature that helps solve a variety of unconnected problems in React that have been encountered over the years of writing and maintaining tens of thousands of components.",[91,419,420,421,424],{},"Long story short, React Hooks allow developers to ",[155,422,423],{},"use React without classes",". Web developers can also extract stateful logic from a component so it can be tested independently and reused within a project.",[91,426,427,428,431],{},"As sometimes complex components bring about certain difficulties, React Hooks let web developers ",[155,429,430],{},"split one component into smaller functions",". They also let web developers “hook into” React state and other React lifecycle features from function components without writing a class.",[91,433,434,435,438],{},"In addition, React Hooks allow developers to ",[155,436,437],{},"reuse stateful logic without changing the component hierarchy",", making it easy to share Hooks among many components or with the community.",[169,440],{},[91,442,443],{},"The above advantages make React an excellent fit for any innovative project - whether it is an entertainment app, a complex analytical tool, a business web application, or a mobile app. The unique benefits of React demonstrate their real value when your users start interacting with your awesome React-built app.",[139,445,125],{"id":446},"react-development-company-react-services-we-offer",[91,448,449],{},"Our expert senior front-end developers, who have been working with React since 2013, can help you to create reusable, scalable and fully functional web apps.",[91,451,452],{},"As early adopters of React, our web developers have already created a variety of reusable React components and full-scale web applications.",[91,454,455,460],{},[104,456,459],{"href":457,"rel":458},"https:\u002F\u002Fitclub.com.au\u002F",[149],"IT Club"," provides the following React.js development services using our best in-house resources:",[333,462,464],{"id":463},"web-application-development-with-react","Web application development with React",[91,466,467],{},"Based on our experience, React is the best way to quickly create large web applications using JavaScript. React allows our web developers to create interactive UIs, easily update components, and develop new features without rewriting your existing code.",[91,469,470],{},"As for SEO, it can be effectively handled through server-side rendering. Moreover, React has behind it an active and fast-growing worldwide community, which, in turn, allows developing great frontends even faster.",[91,472,473,199,477],{},[195,474],{"alt":475,"src":476,"title":475},"Stack Overflow Trends 2009-2020 for React Vue Angular AngularJS","\u002Fuploads\u002FStack_Overflow_Trends.jpg",[169,478],{},[91,480,481,482,487],{},"According to ",[104,483,486],{"href":484,"rel":485},"https:\u002F\u002Finsights.stackoverflow.com\u002Ftrends?tags=reactjs%2Cvue.js%2Cangular%2Cangularjs",[149],"Stack Overflow",", React queries continue to grow steadily, making it by far the most popular JavaScript framework compared to other front-end frameworks.",[333,489,491],{"id":490},"progressive-web-apps","Progressive Web Apps",[91,493,494],{},"React is designed to focus exclusively on applying business logic, providing high scalability and high-speed efficiency to save money and time. These features allow our web developers to adopt modern technology and create Progressive Web Apps.",[333,496,498],{"id":497},"spa-development","SPA development",[91,500,501],{},"Our web developers use React at least for two reasons when developing SPAs (single-page applications).",[91,503,504],{},"Firstly, due to its virtual representation of the DOM, React guarantees perfect efficiency. When a user interacts with an app, the operations are run against the virtual DOM and then rendered on the visible page.",[91,506,507,508,513],{},"Secondly, its server-side rendering supports using ",[104,509,512],{"href":510,"rel":511},"https:\u002F\u002Fnextjs.org\u002F",[149],"Next.js",", which, in turn, is used for static websites as well as a desktop and mobile app, the enterprise, SEO-friendly websites, PWAs, etc.",[333,515,517],{"id":516},"migration-to-react","Migration to React",[91,519,520],{},"Our software engineers ensure a smooth migration from any JavaScript platform to React. Unlike other frameworks, React combines flexibility, the ability to pass rich data through an app, and a powerful composition model, all in one package. It doesn’t need a lot of extra tools.",[91,522,523],{},"Besides that, our developers don’t need to investigate the rest of your technology stack and rewrite your existing code. React allows our web developers to avoid this, saving your resources.",[333,525,527],{"id":526},"mobile-apps-for-ios-and-android-using-react-js","Mobile apps for iOS and Android using React js",[91,529,530,532,533,536],{},[155,531,244],{},", a React framework for making native apps, allows building ",[155,534,535],{},"cross-platform mobile apps"," for iOS and Android using JavaScript and the well-known React architecture.",[91,538,539,540,543],{},"React Native allows React developers to build not ‘just’ a mobile web app or a hybrid app, but a ",[155,541,542],{},"fully fledged mobile app",", identical to the one built in the platform's native language. This is because React uses the same fundamental UI building blocks as regular iOS and Android apps.",[91,545,546,547,550],{},"Another major benefit of React Native is that it does ",[155,548,549],{},"not require recompiling",". This allows us to reload the app instantly with the hot reload supported by React Native. It lets us run the new code while retaining the application’s state.",[91,552,553],{},"However, sometimes when a native language needs to be used for either optimisation or other purposes, React Native lets us elegantly write some parts of the application in the native code and even combine JavaScript with it.",[91,555,556,559],{},[155,557,558],{},"React Native reusable components library"," allows to reduce the time required for mobile development, making the release of your React Native app faster and less costly.",[91,561,562],{},"While React Native would not be seen as the best choice for mobile games, where every millisecond counts, it nevertheless has shown great applicability in some real-life high-loaded apps. Those include Facebook, Instagram, Skype, Tesla, SoundCloud, Airbnb and other well-known projects. Thus, React Native is well-suited for most web apps and projects you want to create.",[91,564,565],{},"We provide React Native app development services.",[567,568,569,570,577],"div",{},"\n    ",[104,571,576],{"className":572,"href":52},[573,574,575],"base-button","base-button--dark","base-button--outlined","\n    Get a quote today\n    ","\n  ",[169,579],{},[333,581,583],{"id":582},"ongoing-support","Ongoing support",[91,585,586,587,589],{},"Looking for a team to upgrade your React application? Or need extensive and affordable maintenance and support? In either case, you can count on our web developers with upgrades, ongoing product support, and the implementation of new features. All the clients who have built React apps with IT Club continue to receive support services.",[169,588],{},[169,590],{},[139,592,131],{"id":593},"additional-react-related-services",[98,595,596,599,602,605,608,611,614,617],{},[101,597,598],{},"Custom React software development",[101,600,601],{},"Development of flexible MVP apps using React",[101,603,604],{},"React Native MVP apps",[101,606,607],{},"Evolution of an existing React app from MVP to enterprise-ready products",[101,609,610],{},"Design of a clear and transparent React structure using the best practices",[101,612,613],{},"Maintenance and refactoring of current apps to enhance readability",[101,615,616],{},"Design of scalable data flow and state management with data normalisation using Redux or Mobx libraries",[101,618,619],{},"A deep dive into the existing codebase of your React app to discover bottlenecks and suggest possible optimisations .",[163,621,622],{},[91,623,624],{},"Our web developers use React.js to create business web apps and high-security consumer-facing web projects.",[567,626,577,627],{},[104,628,630],{"className":629,"href":52},[573,574,575],"\n  Hire React developers\n  ",[169,632],{},[139,634,137],{"id":635},"react-development-expertise-you-get-working-with-us",[91,637,638,639,642,643,646],{},"Our team has experience in developing ",[155,640,641],{},"start-up projects"," where timing is critical. Also, our software engineers have been working on ",[155,644,645],{},"business-level applications",", where it is essential to focus on scalability, safety, stability, optimisation, efficiency and the reduction of technical debt.",[91,648,649],{},"To deliver high-quality products, our web developers follow all the best practices that include code review, test-driven development, ongoing integration, and automated testing.",[91,651,652],{},"Here are some of the reasons why both small and large businesses build their React apps with us:",[98,654,655,658,661,670,673],{},[101,656,657],{},"High seniority level and technical skills of our React developers",[101,659,660],{},"You can scale your team in days, whenever you need it.",[101,662,663,664,669],{},"Our API-first approach allows us to efficiently work together with the front-end and back-end teams, no matter what technology you use - Node.js, ",[104,665,668],{"href":666,"rel":667},"http:\u002F\u002Fitclub.com.au\u002Flaravel-development-services",[149],"PHP",", Ruby or other.",[101,671,672],{},"We build SEO-friendly code that makes web apps visible and indexable to search engines.",[101,674,675],{},"We stay at the top of the latest trends and practices in React web development, and are continuously improving our professional skills.",[91,677,678],{},"See what else you get working with us:",[333,680,682],{"id":681},"rapid-application-development-and-clean-code","Rapid application development and clean code",[91,684,685],{},"With its powerful composition model, React enables our web developers to reuse code in applications, as well as to write and assemble a new, diverse and React reusable components library for further development for further development. Therefore, this strategy reduces the time required for software development, making the release of your web application faster and less costly.",[333,687,689],{"id":688},"custom-react-libraries-and-ui-components-development-services","Custom React libraries and UI components development services",[91,691,692],{},"React allows making the most out of its component-based structure and reusing components where possible. Our software engineers create React libraries and UI parts (buttons, checkboxes, drop-down menus, libraries, etc.) for faster development and easier codebase maintenance.",[333,694,696],{"id":695},"the-tech-stack","The tech stack",[91,698,699],{},"Unsure of which technology would be best for your frontend or backend side? Our web developers can assist you in making the right choice for your project.",[333,701,703],{"id":702},"high-quality-react-team","High-quality React team",[91,705,706,707,710,711,714],{},"This is your chance to ",[155,708,709],{},"get benefited from top talents"," that combine tech know-how and creative minds. ",[155,712,713],{},"Only middle and senior-level engineers"," will work on your application, and they are ready to share their knowledge with you on your React project.",[91,716,717,718,343],{},"Our web developers can also provide you with some essential aspects to consider when selecting a framework for your app. If you are looking for a React JS web development company, ",[104,719,721],{"href":457,"rel":720},[149],"we are here to help",[567,723,577,724],{},[104,725,727],{"className":726,"href":52},[573,574,575],"\n  Get a quote\n  ",[169,729],{},[91,731,732,733,736,737],{},"Is React not a perfect match for your project? Check out other services that ",[104,734,459],{"href":457,"rel":735},[149]," has to offer. Our software engineers deliver high-quality web development on time. ",[169,738],{},[740,741,748],"card",{"link":742,"title":743,"description":744,"logo":745,"site-name":746,"cover-image":747},"https:\u002F\u002Fitclub.com.au\u002Fvue-js-development-services\u002F","Vue Web Development Services","Our expert Vue development team provides Vue js development services to build mobile and user-friendly web apps and single-page applications (SPAs).\u003Cbr>\u003Cbr>Click to learn more.","\u002Fuploads\u002Fit-club-logo.svg","Need a web app? Hire us.","\u002Fuploads\u002Fvue-js-development-at-itclub.com.au-fb-vue.png","\n \n",[169,750],{},[169,752],{},{"title":25,"searchDepth":754,"depth":754,"links":755},2,[756,757,758,770,778,779],{"id":141,"depth":754,"text":107},{"id":234,"depth":754,"text":113},{"id":268,"depth":754,"text":119,"children":759},[760,762,763,764,765,766,767,768,769],{"id":335,"depth":761,"text":336},3,{"id":346,"depth":761,"text":347},{"id":353,"depth":761,"text":354},{"id":360,"depth":761,"text":361},{"id":370,"depth":761,"text":371},{"id":380,"depth":761,"text":381},{"id":392,"depth":761,"text":393},{"id":399,"depth":761,"text":400},{"id":408,"depth":761,"text":409},{"id":446,"depth":754,"text":125,"children":771},[772,773,774,775,776,777],{"id":463,"depth":761,"text":464},{"id":490,"depth":761,"text":491},{"id":497,"depth":761,"text":498},{"id":516,"depth":761,"text":517},{"id":526,"depth":761,"text":527},{"id":582,"depth":761,"text":583},{"id":593,"depth":754,"text":131},{"id":635,"depth":754,"text":137,"children":780},[781,782,783,784],{"id":681,"depth":761,"text":682},{"id":688,"depth":761,"text":689},{"id":695,"depth":761,"text":696},{"id":702,"depth":761,"text":703},"\u002Fuploads\u002Freact-js-development-at-itclub.com.au-facebook.png","2019-08-27T03:20:12.181Z","Hire experienced React.js developers and software engineers for your project. We are a Melbourne-based team. Learn more about the React services we offer.","md",[790,793,796,799,802,805,808,811,814,817],{"question":791,"answer":792},"Is React backend or frontend?","React is a front-end library which works in the browser. React renders on a server using Node, and powers mobile apps using React Native.",{"question":794,"answer":795},"Why use React js?","There are many reasons to use React.js. Firstly, React allows creating reusable UI components. With React, web developers can create large web applications which can change data without reloading the page. Due to its virtual representation of the DOM, React also guarantees perfect efficiency. Lastly, React offers server-side rendering by using Next.js.",{"question":797,"answer":798},"Why is React JS faster?","React uses Virtual DOM that makes the app faster. Virtual DOM allows ReactJS to detect changes in the data and know exactly when to re-render or when to ignore specific parts of the DOM. A UI that works quickly is important in enhancing the overall user experience.",{"question":800,"answer":801},"What is React used for in web development?","ReactJS is used for building user interfaces, specifically for single-page applications (SPA).",{"question":803,"answer":804},"Is there an alternative to React?","Yes, there are many alternatives to React. The most popular are Vue.js, AngularJS, Ember, Svelte, and Preact.",{"question":806,"answer":807},"How does React js work?","React effectively reconstructs a DOM tree in JavaScript, allows efficient diff computations on the nodes, and pushes only those changes to the real DOM which have actually occurred. React allows using the JSX syntax to write concise HTML\u002FXML-like structures in the same file as you write JavaScript code.",{"question":809,"answer":810},"Is React js a framework?","No, it's a JavaScript library which is responsible only for a view composition. This means that you need to use other libraries to make network requests, manage an application state, routing, etc.",{"question":812,"answer":813},"What to use for state management with React?","The most popular state management libraries are Redux and MobX. Recently, Facebook released an experimental library, Recoil, which builds on React primitives and gives benefits such as small size, compatibility with concurrent mode and combining on React's batching.",{"question":815,"answer":816},"Is React js frontend or backend?","React is a front-end library that runs on a browser. React is a JavaScript library which is responsible only for a view composition. It is used for building user interfaces, e.g. for single-page applications (SPA).",{"question":818,"answer":819},"Can React be used for the backend?","No. React is a front-end JavaScript library. However, you can pre-render React components on a server. The best framework for this would be Next.js.",{},{"description":787,"title":14},true,{"title":85,"description":787},{"loc":15},"web-development\u002Freact-js-development-services","At IT Club, you can hire experienced React.js developers, software engineers and architects. Our React developers help startups, SMEs and top Australian companies develop their React projects. We would love to help you with your React js app development.",[828,829,157,830],"Coding","Frontend","UX","UXBhQ_5t77o14oUR_utCRJZaNlK8Kxn4xhsf-FOb6pE",[833,1451,2037,2594],{"id":834,"title":835,"authorBio":836,"body":837,"coverImage":1434,"date":1435,"description":1436,"extension":788,"faq":1437,"heroImage":1434,"lastReviewed":86,"meta":1438,"metadata":1439,"navigation":822,"path":1441,"readingTime":1442,"reviewedAgainst":1443,"seo":1444,"sitemap":1445,"stem":1446,"summary":1447,"tags":1448,"thumbnail":1434,"__hash__":1450},"blog\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach.md","Latitude Financial Data Breach: Lessons for Small Businesses","Written by Elena Osipova, CPA, an emerging cyber security practitioner with professional background in finance, accounting and business operations. She writes about financial data breaches, cyber security governance and practical security controls for Australian small businesses.",{"type":88,"value":838,"toc":1418},[839,842,847,850,870,873,876,879,883,886,889,939,942,945,948,952,1056,1060,1067,1088,1091,1095,1127,1131,1166,1170,1173,1199,1203,1259,1263,1266,1270,1284,1288,1326,1330,1333,1353,1357,1360,1363,1370,1374],[91,840,841],{},"In March 2023, Latitude Financial suffered what remains one of the largest data breaches in Australian history.",[163,843,844],{},[91,845,846],{},"Latitude Financial is the ASX-listed lender behind Gem, GO Mastercard and 28° Global. It provides personal loans, credit cards and point-of-sale interest-free finance to around 2.8 million customer accounts across Australia and New Zealand.",[91,848,849],{},"An attacker who compromised one of Latitude's vendors obtained Latitude employee login credentials and used them to extract customer data from two other service providers. The stolen data included:",[98,851,852,855,858,861,864,867],{},[101,853,854],{},"~7.9 million Australian and NZ driver licence numbers",[101,856,857],{},"~103,000 copies of driver licences or passports",[101,859,860],{},"~53,000 passport numbers",[101,862,863],{},"~6.1 million additional records, some dating back to at least 2005",[101,865,866],{},"income and expense information used in ~900,000 loan applications, including - ~308,000 bank account numbers and ~143,000 credit card or credit card account numbers;",[101,868,869],{},"less than 100 customers with monthly financial statements.",[91,871,872],{},"Many affected people were former customers and applicants, and some information dated back nearly two decades.",[91,874,875],{},"Due to its impact, this breach is among major Australian breaches along with Optus and Medibank, intensifying the debate about privacy reform, data retention and cyber security.",[91,877,878],{},"The weaknesses that contributed to the impact of this breach - third-party access, one compromised account reaching multiple sources of sensitive information, and retaining large volumes of historical data - can exist in businesses of every size. And as for small businesses, there are usually fewer designated defences available for IT and security.",[139,880,882],{"id":881},"what-happened","What happened",[91,884,885],{},"On 16 March 2023, Latitude Financial entered a trading halt at ASX and disclosed a cyberattack, describing it as \"sophisticated and malicious\". It was initially disclosed that approximately 103,000 identification documents and 225,000 customer records were stolen.",[91,887,888],{},"By 27 March, Latitude confirmed the theft of records relating to approximately 14 million customer and applicant records. The stolen information included:",[98,890,891,897,903,909,915,921,927,933],{},[101,892,893,896],{},[155,894,895],{},"Driver licence numbers:"," ~7.9 million Australian and New Zealand",[101,898,899,902],{},[155,900,901],{},"Passport numbers:"," ~53,000 records",[101,904,905,908],{},[155,906,907],{},"Records containing names, addresses, dates of birth and phone numbers:"," ~6.1 million, with some dating back to at least 2005",[101,910,911,914],{},[155,912,913],{},"Images of driver licences or passports:"," 103,000 records",[101,916,917,920],{},[155,918,919],{},"Income and expense information:"," ~900,000 loan applications",[101,922,923,926],{},[155,924,925],{},"Bank account numbers:"," ~308,000 records",[101,928,929,932],{},[155,930,931],{},"Credit card or credit account numbers:","  ~143,000 records",[101,934,935,938],{},[155,936,937],{},"Monthly financial statements:"," less than 100 customers.",[91,940,941],{},"Latitude said bank-account passwords, card expiry dates and three-digit security codes were not compromised.",[91,943,944],{},"Latitude received the ransom demand but refused to pay it, explicitly aligning with the Australian Government's position.",[91,946,947],{},"As of July 2026, no attacker has been publicly identified or charged in connection with this breach.",[139,949,951],{"id":950},"the-timeline","The timeline",[953,954,955,972],"table",{},[956,957,958],"thead",{},[959,960,961,967],"tr",{},[962,963,964],"th",{},[155,965,966],{},"Date",[962,968,969],{},[155,970,971],{},"Event",[973,974,975,986,996,1006,1016,1026,1036,1046],"tbody",{},[959,976,977,983],{},[978,979,980],"td",{},[155,981,982],{},"Prior to 16 March 2023",[978,984,985],{},"An attacker obtains a compromised employee credential through one of Latitude’s vendors.  Latitude detects unusual activity and begins its response.",[959,987,988,993],{},[978,989,990],{},[155,991,992],{},"16 March 2023",[978,994,995],{},"Latitude enters an ASX trading halt and publicly discloses the breach. Early findings: ~330,000 customers and applicants affected.",[959,997,998,1003],{},[978,999,1000],{},[155,1001,1002],{},"27 March 2023",[978,1004,1005],{},"The full scale of the breach disclosed: ~14 million records.",[959,1007,1008,1013],{},[978,1009,1010],{},[155,1011,1012],{},"11 April 2023",[978,1014,1015],{},"Latitude confirms a ransom demand and refuses to pay.",[959,1017,1018,1023],{},[978,1019,1020],{},[155,1021,1022],{},"April - May 2023",[978,1024,1025],{},"~6 weeks of severe business disruption: new lending paused, collections interruptions.",[959,1027,1028,1033],{},[978,1029,1030],{},[155,1031,1032],{},"May 2023",[978,1034,1035],{},"The OAIC and NZ Privacy Commissioner open a joint investigation into Latitude's information handling.",[959,1037,1038,1043],{},[978,1039,1040],{},[155,1041,1042],{},"Aug 2023",[978,1044,1045],{},"Latitude reports $76M of pre-tax cyber-related costs and provisions related to the incident and $98.2M statutory loss after tax.",[959,1047,1048,1053],{},[978,1049,1050],{},[155,1051,1052],{},"2023 - 2024",[978,1054,1055],{},"Gordon Legal and Hayden Stephens and Associates lodged a representative complaint with the OAIC on behalf of affected individuals.",[139,1057,1059],{"id":1058},"how-the-attacker-gained-access","How the attacker gained access",[91,1061,1062,1063,1066],{},"Based on Latitude’s public disclosures, the incident began with a ",[155,1064,1065],{},"third-party credential compromise",", rather than a technical exploit. Here’s how the cybercriminals got in:",[1068,1069,1070,1076,1082],"ol",{},[101,1071,1072,1075],{},[155,1073,1074],{},"Third-party compromise."," The attack originated from one of Latitude’s major vendors.",[101,1077,1078,1081],{},[155,1079,1080],{},"Theft of a valid login credential."," From the vendor environment, the attacker obtained active credentials belonging to a Latitude employee.",[101,1083,1084,1087],{},[155,1085,1086],{},"Large-scale data theft."," The attacker used that credential to gain unauthorised access to personal information of current and historical customers and applicants, resulting in approximately 14 million records stolen.",[91,1089,1090],{},"Public disclosures have not identified malware, a zero-day vulnerability, or phishing against Latitude employees as the initial access method. The confirmed starting point was a compromised credential obtained through a third party that unlocked almost two decades of identity data.",[139,1092,1094],{"id":1093},"_5-reasons-the-breach-had-such-a-large-impact","5 reasons the breach had such a large impact",[1068,1096,1097,1103,1109,1115,1121],{},[101,1098,1099,1102],{},[155,1100,1101],{},"A third-party compromise reached Latitude."," Based on reports, the attacker obtained a valid employee credential through a compromised third party. This shows how a supplier’s security weakness can become a customer’s security incident. Businesses should know which vendors can access their systems and data, limit that access to what is necessary and remove it when it is no longer needed.",[101,1104,1105,1108],{},[155,1106,1107],{},"Stolen credentials worked, at scale."," The compromised credential provided sufficient access for the attacker to retrieve large volumes of data. Public information does not establish whether MFA was absent, bypassed or otherwise ineffective. The suspicious activity was not detected or interrupted early enough to prevent large-scale data theft.",[101,1110,1111,1114],{},[155,1112,1113],{},"Historical data increased the consequences."," Some stolen records dated back to at least 2005 and related to former customers and unsuccessful applicants. Australian Privacy Principle 11.2 generally requires an organisation to take reasonable steps to destroy or de-identify personal information no longer needed, unless it must be retained under other legal requirements. In May 2023, the OAIC and New Zealand Privacy Commissioner started a joint investigation into whether Latitude met that obligation.",[101,1116,1117,1120],{},[155,1118,1119],{},"Valuable identity information was concentrated."," The attackers were able to reach Latitude’s customer and applicant records in the service-provider systems with one set of employee credentials. The stolen information included driver licence and passport details, document images, Medicare information and financial information provided during credit applications. Where retention is legally or operationally necessary, the information should be isolated, encrypted, tightly access-controlled and deleted when the retention requirement ends.",[101,1122,1123,1126],{},[155,1124,1125],{},"Detection did not prevent large-scale theft."," Latitude detected unusual activity and moved to contain the incident, but substantial information had already been compromised. Businesses should have alerts on unusual behaviour such as mass searches, bulk downloads, large exports, access from new locations and one account rapidly accessing several sensitive systems.",[139,1128,1130],{"id":1129},"what-it-cost","What it cost",[98,1132,1133,1143,1149,1155,1161],{},[101,1134,1135,1136,1139,1140,343],{},"In August 2023, Latitude reported ",[155,1137,1138],{},"$76 million in pre-tax March-incident-related costs and provisions",", contributing to a ",[155,1141,1142],{},"$98.2 million after tax loss from continuing operations for the half-year",[101,1144,1145,1148],{},[155,1146,1147],{},"Business operation disruption:"," For around 6 weeks, Latitude paused the new lending and loan collections were disrupted.",[101,1150,1151,1154],{},[155,1152,1153],{},"Cost for reimbursing identity document replacement"," for millions of people",[101,1156,1157,1160],{},[155,1158,1159],{},"Legal and regulatory exposure:"," Serious privacy contraventions can expose a company to substantial civil penalties, although a data breach does not automatically mean that the maximum penalty will apply.",[101,1162,1163],{},[155,1164,1165],{},"Reputational damage.",[139,1167,1169],{"id":1168},"what-latitude-did-well","What Latitude did well",[91,1171,1172],{},"Although the breach exposed serious weaknesses, several aspects of Latitude’s incident response are worth recognising:",[98,1174,1175,1181,1187,1193],{},[101,1176,1177,1180],{},[155,1178,1179],{},"Early disclosure:"," Latitude disclosed the cyberattack and entered a trading halt on 16 March 2023 while the investigation was still underway.",[101,1182,1183,1186],{},[155,1184,1185],{},"Containment and operational action:"," Latitude isolated affected systems, paused parts of its onboarding new customers and worked with cyber security specialists, the ACSC, AFP and other government agencies.",[101,1188,1189,1192],{},[155,1190,1191],{},"Refusal to pay the ransom:"," Latitude publicly stated that it would not pay the attacker, aligning its position with Australian Government advice.",[101,1194,1195,1198],{},[155,1196,1197],{},"Support for affected people:"," Latitude offered to reimburse reasonable costs for replacing compromised identity documents and provided information about protective steps customers could take.",[139,1200,1202],{"id":1201},"_9-lessons-for-your-business","9 lessons for your business",[1068,1204,1205,1211,1217,1223,1229,1235,1241,1247,1253],{},[101,1206,1207,1210],{},[155,1208,1209],{},"Do not keep data longer than necessary."," Review what personal information your business holds, why it’s needed, and how long it must be retained? Australian Privacy Principle 11.2 generally requires an organisation to take reasonable steps to destroy or de-identify personal information it no longer needs, unless it must retain the information under another legal obligation. Historical information increased the scale of the Latitude breach. Cybercriminals cannot steal data your business no longer holds.",[101,1212,1213,1216],{},[155,1214,1215],{},"Minimise stored identity documents."," Verify identity without retaining a full document image where the law and business process allow. If retention is required, store only the minimum information, encrypt it, isolate it, restrict access and delete it as soon as the applicable retention period ends.",[101,1218,1219,1222],{},[155,1220,1221],{},"Your vendors' security affects your business."," Know which third parties hold your data or can access your systems. This may include IT providers, bookkeepers and software platforms. Require MFA, prompt breach notification and clear security obligations.",[101,1224,1225,1228],{},[155,1226,1227],{},"Review third-party access regularly."," Keep a record of every vendor account, what it can access and who approved it. Remove access immediately when it is no longer required.",[101,1230,1231,1234],{},[155,1232,1233],{},"Make stolen credentials insufficient."," Require MFA for remote, administrator and third-party access. Give every account only Limit each account only the access it needs. Set alerts on unusual behaviour, such as new login locations, bulk downloads or access outside expected hours.",[101,1236,1237,1240],{},[155,1238,1239],{},"Control large data exports."," Restrict who can download or export sensitive information. Set alerts on unusually large downloads, repeated searches or one account accessing several sensitive systems in a short period.",[101,1242,1243,1246],{},[155,1244,1245],{},"Test your incident response plan."," A written plan is useful only if people know how to use it. Run a simple exercise covering containment, notifications, customer communication and contact with your IT provider.",[101,1248,1249,1252],{},[155,1250,1251],{},"Decide your ransom position before an incident."," Document who has authority to make the decision and obtain legal, law-enforcement, insurance and incident-response advice. Paying a ransom does not guarantee that stolen data will be deleted, returned or kept private.",[101,1254,1255,1258],{},[155,1256,1257],{},"Explain that early breach figures may change."," Clearly label early figures as preliminary. Then may change as the forensic investigation progresses.",[139,1260,1262],{"id":1261},"how-cyber-security-frameworks-apply","How cyber security frameworks apply",[91,1264,1265],{},"While the publicly available information is limited and does not provide enough technical detail to map every stage of the Latitude attack, the incident can still be examined using established cyber security frameworks.",[333,1267,1269],{"id":1268},"mitre-attck-helps-understand-the-attackers-behaviour","MITRE ATT&CK helps understand the attacker’s behaviour",[98,1271,1272,1278],{},[101,1273,1274,1277],{},[155,1275,1276],{},"Valid Accounts (T1078):"," This technique is consistent with the publicly known facts because the attacker obtained a valid employee credential to gain unauthorised access to sensitive information.",[101,1279,1280,1283],{},[155,1281,1282],{},"Data from Information Repositories (T1213):"," The data theft from customer and applicant systems may be consistent with this technique.",[333,1285,1287],{"id":1286},"nist-cybersecurity-framework-20-helps-organise-the-lessons","NIST Cybersecurity Framework 2.0 helps organise the lessons",[98,1289,1290,1296,1302,1308,1314,1320],{},[101,1291,1292,1295],{},[155,1293,1294],{},"Govern:"," Assign responsibility for cyber security, privacy, data retention and third-party risk. Set security requirements for vendors and check that they are followed.",[101,1297,1298,1301],{},[155,1299,1300],{},"Identify:"," Know what personal information the business holds, where it is stored, why it is needed, who can access it and when it should be deleted.",[101,1303,1304,1307],{},[155,1305,1306],{},"Protect:"," Use least privilege, strong MFA, encryption, access segmentation and controls that limit large downloads or exports.",[101,1309,1310,1313],{},[155,1311,1312],{},"Detect:"," Monitor successful and failed logins. Alert on unusual locations, new devices, mass downloads and access across sensitive systems.",[101,1315,1316,1319],{},[155,1317,1318],{},"Respond:"," Maintain and test an incident-response plan covering containment, legal and privacy assessment, communication and customer support.",[101,1321,1322,1325],{},[155,1323,1324],{},"Recover:"," Restore services safely, support affected people and update systems, contracts and retention practices after the incident.",[333,1327,1329],{"id":1328},"acscs-essential-eight","ACSC’s Essential Eight",[91,1331,1332],{},"Although the Essential Eight does not cover every issue raised by this data breach, it is a useful Australian technical baseline. The most relevant strategies include:",[98,1334,1335,1341,1347],{},[101,1336,1337,1340],{},[155,1338,1339],{},"Multi-factor authentication:"," Require MFA for employees, administrators, vendors and access to sensitive systems.",[101,1342,1343,1346],{},[155,1344,1345],{},"Restrict administrative privileges:"," Give your employees and service providers only the access required for their work. Review privileged access regularly and remove it when it is no longer needed.",[101,1348,1349,1352],{},[155,1350,1351],{},"Regular backups:"," Maintain protected and tested backups to support operational recovery.",[139,1354,1356],{"id":1355},"final-takeaway","Final takeaway",[91,1358,1359],{},"The Latitude breach was not only a story about a compromised credential. It also showed how much sensitive information one account could reach, how third-party access can connect multiple systems, and how historical data can increase the harm caused by an incident.",[91,1361,1362],{},"Small businesses may hold fewer records, but the same risks apply. Know what personal information you hold, remove information you no longer need, limit each account to the minimum access required and monitor unusual activity after login.",[91,1364,1365,1366,1369],{},"Use our ",[104,1367,1368],{"href":37},"DIY cyber security health check"," to review your current controls and identify practical steps for improvement.",[139,1371,1373],{"id":1372},"sources-used","Sources used",[98,1375,1376,1379,1382,1385,1388,1391,1394,1397,1400,1403,1406,1409,1412,1415],{},[101,1377,1378],{},"Latitude Financial, Cybercrime Update, 20 March 2023",[101,1380,1381],{},"Latitude Financial, Cybercrime Update, 27 March 2023",[101,1383,1384],{},"Latitude Financial, Cybercrime Update 11 April 2023",[101,1386,1387],{},"Latitude Financial, Latitude Cyber Response",[101,1389,1390],{},"OAIC, Joint Australia-New Zealand investigation into Latitude group",[101,1392,1393],{},"OAIC, Statement on Latitude Financial data breach",[101,1395,1396],{},"New Zealand Office of the Privacy Commissioner, New Zealand - Australia investigation into Latitude breach begins",[101,1398,1399],{},"Latitude Group Holdings, 1H23 Results",[101,1401,1402],{},"MITRE ATT&CK, Valid Accounts - T1078",[101,1404,1405],{},"MITRE ATT&CK, Data from Information Repositories - T1213",[101,1407,1408],{},"NIST, Cybersecurity Framework 2.0",[101,1410,1411],{},"ASD, ACSC’s Essential Eight Maturity Model",[101,1413,1414],{},"Australian Government, Australian Privacy Principles Guidelines, Chapter 11",[101,1416,1417],{},"Gordon Legal, Latitude Financial privacy breach representative complaint",{"title":25,"searchDepth":754,"depth":754,"links":1419},[1420,1421,1422,1423,1424,1425,1426,1427,1432,1433],{"id":881,"depth":754,"text":882},{"id":950,"depth":754,"text":951},{"id":1058,"depth":754,"text":1059},{"id":1093,"depth":754,"text":1094},{"id":1129,"depth":754,"text":1130},{"id":1168,"depth":754,"text":1169},{"id":1201,"depth":754,"text":1202},{"id":1261,"depth":754,"text":1262,"children":1428},[1429,1430,1431],{"id":1268,"depth":761,"text":1269},{"id":1286,"depth":761,"text":1287},{"id":1328,"depth":761,"text":1329},{"id":1355,"depth":754,"text":1356},{"id":1372,"depth":754,"text":1373},"\u002Fcovers\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial.jpg","2026-07-27T00:00:00.000Z","The 2023 Latitude Financial breach exposed millions of customer and applicant records. Learn how third-party access, stolen credentials and excessive data retention increased the impact - and what small businesses should do differently.",[],{},{"description":1440,"title":835},"How the 2023 Latitude Financial incident happened. What Australian small businesses can learn about data retention, vendor access, MFA and breach response.","\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach",10,"Reviewed against current guidance from ASD Australian Cyber Security Centre, the OAIC, NIST CSF 2.0 and MITRE ATT&CK",{"title":835,"description":1436},{"loc":1441},"cyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach","The 2023 Latitude Financial breach exposed approximately 14 million records, including information dating back to 2005. Here is what Australian businesses can learn about data retention, third-party access, stolen credentials and breach response.",[48,1449],"Breach Lessons","TA8niaCikqD3pvid8DbV6jcw4Bh_aFDwyyEIa8P8djs",{"id":1452,"title":1453,"authorBio":1454,"body":1455,"coverImage":2022,"date":1435,"description":2023,"extension":788,"faq":2024,"heroImage":2022,"lastReviewed":86,"meta":2025,"metadata":2026,"navigation":822,"path":2028,"readingTime":2029,"reviewedAgainst":2030,"seo":2031,"sitemap":2032,"stem":2033,"summary":2034,"tags":2035,"thumbnail":2022,"__hash__":2036},"blog\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank-breach.md","What The Medibank Breach Teaches Small Businesses","Written by Elena Osipova, CPA, an emerging Cyber Security Practitioner. Elena writes about enterprise breaches, cyber security governance and practical security controls to help Australian small businesses improve their own defences.",{"type":88,"value":1456,"toc":2006},[1457,1460,1465,1468,1471,1474,1476,1479,1482,1485,1488,1490,1656,1658,1661,1681,1688,1690,1722,1724,1768,1772,1775,1795,1799,1861,1863,1866,1870,1894,1898,1930,1932,1935,1947,1949,1952,1955,1960,1962],[91,1458,1459],{},"In October 2022, Medibank, one of Australia's largest private health insurers, disclosed that a cybercriminal had stolen about 520GB of data. The breach affected around 9.7 million current and former Medibank, ahm and international customers and representatives, including people whose sensitive health claims information was exposed.",[163,1461,1462],{},[91,1463,1464],{},"Through its Medibank and ahm brands, the group insures millions of people across Australia.",[91,1466,1467],{},"The weaknesses that contributed to this breach were not unusual. According to allegations filed by the Australian Information Commissioner, an employee of a Medibank IT contractor saved Medibank credentials in his browser profile on a work computer. When he signed into the same browser profile on a personal computer, the credentials synchronised to that device and were later stolen by malware.",[91,1469,1470],{},"A cybercriminal then used the compromised credentials to access Medibank’s remote-access VPN, which did not require MFA for that login method. Medibank’s security software raised alerts about suspicious activity, but they were delayed to triage for weeks.",[91,1472,1473],{},"Three basic controls failed in a large organisation. Every one of them could be missing in small businesses too.",[139,1475,882],{"id":881},[91,1477,1478],{},"On 13 October 2022, Medibank disclosed unusual activity on its network and initially said there was no evidence that customer data had been removed. On 19 and 22 October, an attacker contacted Medibank and supplied sample files. Medibank later confirmed that information connected to around 9.7 million people had been stolen. The OAIC alleges that about 520GB of data was exfiltrated between late August and 13 October 2022.",[91,1480,1481],{},"The attacker demanded US$10 million. Medibank refused to pay, explaining that payment could not guarantee the return or deletion of the data and might encourage further extortion.",[91,1483,1484],{},"From 9 November to 1 December 2022, stolen information was published on a dark-web leak site in stages, fully releasing the dataset. Published files included highly sensitive health claims information, including records about HIV, drug and alcohol treatment, mental health, and abortions. Australian authorities later attributed the attack to Russian national Aleksandr Ermakov, who was associated with the REvil cybercrime group.",[91,1486,1487],{},"In January 2024, Australia used its cyber sanctions framework for the first time and designated Aleksandr Ermakov for his role in the Medibank breach, imposing targeted financial sanctions and a travel ban. Dealing with a designated person or their assets can be a criminal offence carrying severe penalties, including up to 10 years’ imprisonment for an individual.",[139,1489,951],{"id":950},[953,1491,1492,1504],{},[956,1493,1494],{},[959,1495,1496,1500],{},[962,1497,1498],{},[155,1499,966],{},[962,1501,1502],{},[155,1503,971],{},[973,1505,1506,1516,1526,1536,1546,1556,1566,1576,1586,1596,1606,1616,1626,1636,1646],{},[959,1507,1508,1513],{},[978,1509,1510],{},[155,1511,1512],{},"Prior to 7 August 2022",[978,1514,1515],{},"A contractor employee saved Medibank credentials in a browser profile on a work computer. The credentials were later synchronised to his personal computer.",[959,1517,1518,1523],{},[978,1519,1520],{},[155,1521,1522],{},"Around 7 August 2022",[978,1524,1525],{},"Malware on the personal computer stole the Medibank credentials.",[959,1527,1528,1533],{},[978,1529,1530],{},[155,1531,1532],{},"12 August 2022",[978,1534,1535],{},"The attacker tested the stolen admin credentials against Medibank’s Microsoft Exchange server.",[959,1537,1538,1543],{},[978,1539,1540],{},[155,1541,1542],{},"Around 23 August 2022",[978,1544,1545],{},"The attacker first logged in to Medibank’s GlobalProtect VPN, with no MFA required.",[959,1547,1548,1553],{},[978,1549,1550],{},[155,1551,1552],{},"24 - 25 August 2022",[978,1554,1555],{},"Medibank’s security software generated alerts, sending them to an IT operations mailbox. The OAIC alleges they were not appropriately triaged or escalated.",[959,1557,1558,1563],{},[978,1559,1560],{},[155,1561,1562],{},"25 August - 13 October 2022",[978,1564,1565],{},"The attacker accessed Medibank's internal systems and exfiltrated about 520GB of data.",[959,1567,1568,1573],{},[978,1569,1570],{},[155,1571,1572],{},"11 October 2022",[978,1574,1575],{},"Medibank triaged a high-severity alert and engaged its incident-response partner.",[959,1577,1578,1583],{},[978,1579,1580],{},[155,1581,1582],{},"13 October 2022",[978,1584,1585],{},"Medibank publicly discloses the incident, initially stating that there was no evidence that customer data had been removed.",[959,1587,1588,1593],{},[978,1589,1590],{},[155,1591,1592],{},"19 and 22 October 2022",[978,1594,1595],{},"The attacker contacted Medibank and supplied sample files with stolen data.",[959,1597,1598,1603],{},[978,1599,1600],{},[155,1601,1602],{},"7 November 2022",[978,1604,1605],{},"Medibank confirmed the scale of the breach: 9.7 million people and publicly refused to pay the ransom.",[959,1607,1608,1613],{},[978,1609,1610],{},[155,1611,1612],{},"9 November - 1 December 2022",[978,1614,1615],{},"Stolen information was published on the dark web in stages, ending with the full 520GB released.",[959,1617,1618,1623],{},[978,1619,1620],{},[155,1621,1622],{},"27 June 2023",[978,1624,1625],{},"APRA announced a $250M increase in Medibank’s capital adequacy requirement until remediation was completed to APRA’s satisfaction.",[959,1627,1628,1633],{},[978,1629,1630],{},[155,1631,1632],{},"23 January 2024",[978,1634,1635],{},"Australia imposed its first cyber sanction, designating Aleksandr Ermakov for his role in the breach.",[959,1637,1638,1643],{},[978,1639,1640],{},[155,1641,1642],{},"5 June 2024",[978,1644,1645],{},"The OAIC files civil penalty proceedings in the Federal Court over alleged failure to take reasonable steps to protect personal information.",[959,1647,1648,1653],{},[978,1649,1650],{},[155,1651,1652],{},"As of July 2026",[978,1654,1655],{},"The OAIC proceedings continued, and the Medibank class action remained listed as open in the Federal Court.",[139,1657,1059],{"id":1058},[91,1659,1660],{},"Based on the OAIC’s allegations and Medibank’s public updates, the incident began with stolen credentials, remote access without MFA and an account with extensive privileges. Here’s how the hacker gained access:",[1068,1662,1663,1669,1675],{},[101,1664,1665,1668],{},[155,1666,1667],{},"Credential theft through infostealer malware."," TMedibank credentials saved in a contractor employee’s browser profile were synchronised to his personal computer and were stolen by malware.",[101,1670,1671,1674],{},[155,1672,1673],{},"Remote access without MFA."," The VPN was configured to accept a username and password and did not require MFA.",[101,1676,1677,1680],{},[155,1678,1679],{},"Broad access and delayed escalation."," The compromised admin account could access most Medibank systems. The OAIC alleges that security alerts were generated from 24 August onwards but were not appropriately triaged or escalated, allowing the hacker to locate and exfiltrate about 520GB of data over seven weeks.",[91,1682,1683,1684,1687],{},"The publicly available evidence describes a ",[155,1685,1686],{},"data-theft and extortion"," incident rather than ransomware with encrypted systems. The attacker simply used valid credentials to access systems and steal data, then demanded payment to prevent publication.",[139,1689,1094],{"id":1093},[1068,1691,1692,1698,1704,1710,1716],{},[101,1693,1694,1697],{},[155,1695,1696],{},"No MFA on remote access."," A username and password were enough for the hacker to access Medibank’s systems. MFA would have added an important barrier and may have prevented or limited the initial access.",[101,1699,1700,1703],{},[155,1701,1702],{},"An unmanaged personal device."," Corporate credentials were synchronised to a personal computer outside Medibank’s managed environment, where malware stole them.",[101,1705,1706,1709],{},[155,1707,1708],{},"Poor alert response."," Detection software generated alerts, but the process for reviewing, triaging and escalating them did not work as intended.",[101,1711,1712,1715],{},[155,1713,1714],{},"One account had very broad access."," The service-desk account had access to \"most, if not all, systems\", so one stolen credential became keys to the whole building.",[101,1717,1718,1721],{},[155,1719,1720],{},"Known weaknesses were not fixed in time."," The OAIC alleges Medibank knew about the security gaps, including the MFA gap, through its cyber security audits, and failed to fix them in time.",[139,1723,1130],{"id":1129},[98,1725,1726,1732,1738,1744,1750,1756,1762],{},[101,1727,1728,1731],{},[155,1729,1730],{},"Direct response and remediation costs reached tens of millions of dollars"," across several financial years, before any final litigation outcomes.",[101,1733,1734,1737],{},[155,1735,1736],{},"Blackmail and ransom demands:"," Medibank refused the US$10M ransom,  and the stolen data was later published.",[101,1739,1740,1743],{},[155,1741,1742],{},"APRA's $250 million capital adequacy adjustment:"," This was not a fine, it required Medibank to hold additional capital until APRA was satisfied with the remediation program.",[101,1745,1746,1749],{},[155,1747,1748],{},"Regulatory and legal scrutiny:"," The ongoing OAIC civil penalty proceedings and a Federal Court class action, still listed as open.",[101,1751,1752,1755],{},[155,1753,1754],{},"Harm to affected people:",": Published information included identity details and sensitive health claims data, creating risks of fraud, scams, blackmail, identity theft and emotional distress for the affected individuals.",[101,1757,1758,1761],{},[155,1759,1760],{},"Wider impact:",": The breach contributed to national debate about privacy, cyber security and ransomware. In 2024, Australia imposed its first cyber sanction in response to the incident.",[101,1763,1764,1767],{},[155,1765,1766],{},"Reputational damage:"," The incident affected customer trust and kept Medibank under public, regulatory and legal scrutiny for years.",[139,1769,1771],{"id":1770},"what-medibank-did-well","What Medibank did well",[91,1773,1774],{},"Although the breach exposed serious weaknesses and early breach figures changed as the incident investigation progressed, several aspects of Medibank’s incident response are worth recognising:",[98,1776,1777,1780,1783,1786,1789,1792],{},[101,1778,1779],{},"Medibank provided frequent public updates as the breach scope became clearer.",[101,1781,1782],{},"It also notified regulators and law-enforcement agencies.",[101,1784,1785],{},"Medibank engaged external cyber incident-response specialists.",[101,1787,1788],{},"It refused to pay ransom, aligning with the Australian Government view.",[101,1790,1791],{},"Medibank also offered support measures, including identity monitoring and hardship support for affected customers",[101,1793,1794],{},"It also committed to remediation and security investment.",[139,1796,1798],{"id":1797},"_10-lessons-for-your-business","10 lessons for your business",[1068,1800,1801,1807,1813,1819,1825,1831,1837,1843,1849,1855],{},[101,1802,1803,1806],{},[155,1804,1805],{},"Mandatory MFA."," If one control defines this breach, it's this. Enforce mandatory MFA for VPNs, emails, cloud systems, admin accounts, contractor accounts and third-party support access.",[101,1808,1809,1812],{},[155,1810,1811],{},"Properly manage contractor access."," Administrator access should be role-based rather than universal across internal systems. Privileged access should only be granted when required, time-limited, approved, monitored and reviewed regularly. Contractors should not have privileged access to all systems and databases.",[101,1814,1815,1818],{},[155,1816,1817],{},"Require managed devices for corporate access."," Personal or unmanaged devices should not access sensitive systems unless strong technical controls are in place. Access should be limited to devices that are managed, compliant, patched and monitored.",[101,1820,1821,1824],{},[155,1822,1823],{},"Apply least privilege."," Give each user only the access needed for their role. Review privileged access regularly and remove it when it is no longer required.",[101,1826,1827,1830],{},[155,1828,1829],{},"Strengthen browser and credential security."," Do not allow corporate credentials to be stored in browsers. Use an approved password manager and configure managed browsers to control password saving and profile synchronisation.",[101,1832,1833,1836],{},[155,1834,1835],{},"Every alert needs an owner."," Decide who acts on warnings from your antivirus, bank and software - and how they should respond to them.",[101,1838,1839,1842],{},[155,1840,1841],{},"Reduce sensitive data exposure."," Keep only the information you need, restrict access, separate high-risk data, encrypt it where appropriate and monitor unusual access or large data transfers.",[101,1844,1845,1848],{},[155,1846,1847],{},"Network segmentation."," Consider separating your network into secure zones to reduce access to sensitive data.",[101,1850,1851,1854],{},[155,1852,1853],{},"Act on cyber security findings."," The OAIC alleges that Medibank's cyber security audits flagged the MFA gap. Treat audit findings, penetration-test results and insurer questionnaires as actions with owners, deadlines and management oversight.",[101,1856,1857,1860],{},[155,1858,1859],{},"Train employees and contractors."," Cover secure credential storage, approved password managers, MFA methods, risk of browser synchronisation, phishing methods, incident reporting and how to correctly respond to credential theft attempts.",[139,1862,1262],{"id":1261},[91,1864,1865],{},"While the publicly available information does not provide every technical detail of the Medibank attack, the incident can still be examined using established cyber security frameworks. This can help turn the incident into a structured set of lessons.",[333,1867,1869],{"id":1868},"mitre-attck-helps-understand-the-attackers-behaviours","MITRE ATT&CK helps understand the attacker's behaviours",[98,1871,1872,1878,1884,1889],{},[101,1873,1874,1877],{},[155,1875,1876],{},"Credentials from Web Browsers (T1555.003):"," The OAIC alleges that Medibank credentials saved in a contractor’s work browser profile were synchronised to a personal computer and later stolen by information-stealing malware.",[101,1879,1880,1883],{},[155,1881,1882],{},"External Remote Services (T1133):"," The attacker allegedly used the stolen credentials to connect to Medibank systems through its GlobalProtect VPN.",[101,1885,1886,1888],{},[155,1887,1276],{}," The attacker used an active Medibank administrator account that allowed the login to appear similar to authorised activity.",[101,1890,1891,1893],{},[155,1892,1282],{}," After entering the environment, the attacker allegedly accessed internal systems and databases containing customer identity and health claims information.",[333,1895,1897],{"id":1896},"nist-cybersecurity-framework-20-helps-organise-management-responsibilities","NIST Cybersecurity Framework 2.0 helps organise management responsibilities",[98,1899,1900,1905,1910,1915,1920,1925],{},[101,1901,1902,1904],{},[155,1903,1294],{}," Assign responsibility for cyber security, privacy and third-party access. Set clear security requirements for contractors and ensure that known audit findings are recorded, prioritised and fixed.",[101,1906,1907,1909],{},[155,1908,1300],{}," Know which accounts have broad access, which devices can connect remotely, where sensitive customer information is stored and which systems would create the greatest harm if compromised.",[101,1911,1912,1914],{},[155,1913,1306],{}," Require strong MFA for remote and privileged access. Use managed devices, approved password manager software, least privilege, network segmentation and controls that limit access to sensitive databases.",[101,1916,1917,1919],{},[155,1918,1312],{}," Monitor VPN access, privileged-account activity, unusual devices, large searches or exports and suspicious connections between internal systems. Ensure every important alert has an owner and a defined escalation process.",[101,1921,1922,1924],{},[155,1923,1318],{}," Maintain and test an incident-response plan. It should cover disabling compromised accounts, revoking active sessions, isolating affected systems, investigating alerts, notifying regulators and communicating with affected customers.",[101,1926,1927,1929],{},[155,1928,1324],{}," Restore affected services safely, support affected people, review what went wrong and improve access controls, monitoring, contractor arrangements and incident-response procedures.",[333,1931,1329],{"id":1328},[91,1933,1934],{},"Although the Essential Eight does not cover every issue seen in this breach, it provides a useful Australian technical baseline. The most relevant to Medibank’s breach strategy include:",[98,1936,1937,1942],{},[101,1938,1939,1941],{},[155,1940,1339],{}," Require MFA for VPN access, privileged accounts, contractors and systems holding sensitive information.",[101,1943,1944,1946],{},[155,1945,1345],{}," Give employees and contractors only the access needed for their work. Use separate privileged accounts, review access regularly and remove it when it is no longer required.",[139,1948,1356],{"id":1355},[91,1950,1951],{},"The Medibank breach is sometimes framed as the work of a sophisticated Russian hacker. The practical lesson is simpler: browser-synchronised credentials were stolen from a personal device, remote access did not require MFA for the login method used, an admin account had extensive access, and security alerts were not promptly handled.",[91,1953,1954],{},"Small businesses may have fewer IT and security resources, but the same risks still matter. Know who can access your systems, require MFA, use managed devices, limit each account to the minimum access required, control browser synchronisation and make sure every important security alert has an owner.",[91,1956,1365,1957,1959],{},[104,1958,1368],{"href":37}," to review your current controls and identify practical steps to protect your business.",[139,1961,1373],{"id":1372},[98,1963,1964,1967,1970,1973,1976,1979,1982,1985,1988,1991,1994,1997,2000,2003],{},[101,1965,1966],{},"Office of the Australian Information Commissioner, Civil penalty action against Medibank and the filed concise statement (June 2024).",[101,1968,1969],{},"Australian Prudential Regulation Authority, APRA takes action against Medibank Private in relation to cyber incident” (27 June 2023).",[101,1971,1972],{},"Australian Government - Department of Foreign Affairs and Trade, Cyber sanctions in response to Medibank Private cyber attack (23 January 2024).",[101,1974,1975],{},"Australian Government - Department of Foreign Affairs and Trade, Significant cyber incidents sanctions framework.",[101,1977,1978],{},"Australian Government - Department of Foreign Affairs and Trade — Guidance Note: Cyber sanctions.",[101,1980,1981],{},"Federal Court of Australia, Current class actions - McClure v Medibank Private Limited, VID64\u002F2023.",[101,1983,1984],{},"Medibank, Cybercrime updates published from 13 October to 1 December 2022.",[101,1986,1987],{},"MITRE ATT&CK Enterprise framework, Credentials from Web Browsers, T1555.003.",[101,1989,1990],{},"MITRE ATT&CK Enterprise framework, External Remote Services, T1133.",[101,1992,1993],{},"MITRE ATT&CK Enterprise framework, Valid Accounts, T1078.",[101,1995,1996],{},"MITRE ATT&CK Enterprise framework, Data from Information Repositories, T1213.",[101,1998,1999],{},"National Institute of Standards and Technology, NIST Cybersecurity Framework 2.0.",[101,2001,2002],{},"ASD’s Australian Cyber Security Centre, Essential Eight explained.",[101,2004,2005],{},"ASD’s Australian Cyber Security Centre, Essential Eight maturity model.",{"title":25,"searchDepth":754,"depth":754,"links":2007},[2008,2009,2010,2011,2012,2013,2014,2015,2020,2021],{"id":881,"depth":754,"text":882},{"id":950,"depth":754,"text":951},{"id":1058,"depth":754,"text":1059},{"id":1093,"depth":754,"text":1094},{"id":1129,"depth":754,"text":1130},{"id":1770,"depth":754,"text":1771},{"id":1797,"depth":754,"text":1798},{"id":1261,"depth":754,"text":1262,"children":2016},[2017,2018,2019],{"id":1868,"depth":761,"text":1869},{"id":1896,"depth":761,"text":1897},{"id":1328,"depth":761,"text":1329},{"id":1355,"depth":754,"text":1356},{"id":1372,"depth":754,"text":1373},"\u002Fcovers\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank.jpg","How stolen browser-saved credentials, remote access without MFA and missed security alerts contributed to the 2022 Medibank data breach - and what Australian small businesses can learn from it.",[],{},{"description":2027,"title":1453},"How the 2022 Medibank data breach happened & what Australian small businesses can learn about contractor access, browser-saved credentials, MFA and security alerts.","\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank-breach",11,"Reviewed against public information from the OAIC, APRA, ASD’s Australian Cyber Security Centre, DFAT, Medibank, MITRE ATT&CK and NIST SCF 2.0",{"title":1453,"description":2023},{"loc":2028},"cyber-security\u002Fbreach-lessons\u002Fmedibank-breach","The 2022 Medibank data breach made headlines, but the weaknesses that contributed to it are not unique to large companies. Here are the practical lessons small businesses can take from the incident.",[48,1449],"DrwgvJLPjR03gDBSyfBEqBqmq6B3GAzL3RFiqFrTSww",{"id":2038,"title":2039,"authorBio":2040,"body":2041,"coverImage":2562,"date":1435,"description":2563,"extension":788,"faq":2564,"heroImage":2562,"lastReviewed":86,"meta":2583,"metadata":2584,"navigation":822,"path":37,"readingTime":1442,"reviewedAgainst":2587,"seo":2588,"sitemap":2589,"stem":2590,"summary":2563,"tags":2591,"thumbnail":2562,"__hash__":2593},"blog\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check.md","The DIY Cyber Security Health Check for Small Business","Written by Elena Osipova, CPA, an emerging Cyber Security Practitioner. Elena writes about cyber security governance and practical security controls for Australian small businesses.",{"type":88,"value":2042,"toc":2546},[2043,2046,2052,2058,2064,2067,2071,2082,2128,2131,2151,2155,2162,2166,2169,2208,2212,2242,2246,2284,2288,2320,2325,2329,2338,2349,2352,2394,2401,2408,2412,2415,2418,2441,2445,2448,2451,2460,2469,2473,2476,2487,2490,2504,2506,2508],[91,2044,2045],{},"You don't need a consultant to find many of your most common cyber risks. One structured afternoon can uncover preventable gaps, such as a former employee's active login, a backup that doesn't restore files, or a payment process that trusts email alone.",[91,2047,2048,2051],{},[155,2049,2050],{},"To complete this checklist, allow around three to four hours",". A very small business may finish much sooner, while a business with more users, devices and cloud services may need additional time. You'll need administrator access to Microsoft 365 or Google Workspace, access to your backup system, and a notepad or spreadsheet for recording your findings.",[91,2053,2054,2057],{},[155,2055,2056],{},"The method matters more than the tools: look at evidence, not memory",". “I think only two people have admin access” is an assumption. Opening the admin panel and counting them gives you a fact. Each step below asks you to check an actual setting, process or record.",[91,2059,2060,2063],{},[155,2061,2062],{},"Write down every issue you find",". Unless some findings appear urgent, don’t stop to fix each issue as you go, or you may burn the whole afternoon on the first item. Fixing them comes later, in priority order shown below.",[91,2065,2066],{},"However, act immediately if you find a clear sign of active compromise. Tis includes an unknown account administrator, an unauthorised payment or an email forwarding rule you did not create.",[139,2068,2070],{"id":2069},"step-1-accounts-and-access-60-minutes","Step 1: Accounts and access - 60 minutes",[91,2072,2073,2074,2077,2078,2081],{},"Open the ",[155,2075,2076],{},"Microsoft 365 Admin Centre"," or ",[155,2079,2080],{},"Google Workspace Admin Console"," and check six things:",[98,2083,2084,2090,2104,2110,2116,2122],{},[101,2085,2086,2089],{},[155,2087,2088],{},"The user list."," Read every name. Is anyone no longer with the business but still active? Is there an account you cannot explain? Record former users for removal. Remove unknown users urgently.",[101,2091,2092,2095,2096,2099,2100,2103],{},[155,2093,2094],{},"MFA coverage."," Confirm that every user is required to use MFA and has completed registration. ",[155,2097,2098],{},"In Microsoft 365",", don’t rely only on the legacy per-user MFA status: MFA may instead be enforced through Security Defaults or Conditional Access. Check both - the organisation-wide policy and the users who have registered. ",[155,2101,2102],{},"In Google Workspace",", check 2-Step Verification enrolment and enforcement.",[101,2105,2106,2109],{},[155,2107,2108],{},"Who's an administrator?"," Count the accounts with administrator roles. There should be very few, and you should be able to explain why each person needs that level of access.",[101,2111,2112,2115],{},[155,2113,2114],{},"Guest and external access."," Review guest users, contractors, delegated mailbox access and connected third-party applications. Remove access that is no longer required.",[101,2117,2118,2121],{},[155,2119,2120],{},"Email forwarding rules."," Check the business owner's and finance mailboxes for rules that forward messages outside the business. Cyber criminals who compromise email accounts may create a hidden forwarding rule. It may remain active after the password is changed. Treat anything you do not recognise as urgent.",[101,2123,2124,2127],{},[155,2125,2126],{},"Account recovery."," For owner and administrator accounts, check the recovery email addresses, phone numbers and backup methods. Remove outdated details. Store emergency recovery codes securely and make sure the business - not one employee personally - controls the recovery process.",[91,2129,2130],{},"Other important account checks:",[98,2132,2133,2139,2145],{},[101,2134,2135,2138],{},[155,2136,2137],{},"Email domain protection."," If your business uses its own email domain, ask your email provider or IT administrator to confirm that SPF, DKIM and DMARC are configured correctly. These help other email systems recognise messages that falsely claim to come from your domain.",[101,2140,2141,2144],{},[155,2142,2143],{},"Domain-name protection."," Sign in to your domain registrar and confirm that your business controls the account, MFA is turned on, the recovery details are current and automatic renewal is enabled. Losing control of your domain can affect your website, email and password resets.",[101,2146,2147,2150],{},[155,2148,2149],{},"Passwords and shared accounts."," Check whether staff reuse passwords or share one login. Each person should have their own account. All important accounts should use unique passwords stored in a reputable password manager.",[333,2152,2154],{"id":2153},"evidence-to-keep","Evidence to keep",[91,2156,2157,2158,2161],{},"Export or screenshot the user list and MFA report. Date it. ",[155,2159,2160],{},"This is your baseline"," for next time. Store this user list securely as it contains personal information and details that could help a cyber criminal.",[139,2163,2165],{"id":2164},"step-2-money-paths-30-minutes","Step 2: Money paths - 30 minutes",[91,2167,2168],{},"Review your actual payment process and recent examples:",[98,2170,2171,2181,2202],{},[101,2172,2173,2176,2177,2180],{},[155,2174,2175],{},"How do suppliers change their bank details?"," If the answer is \"by email\", record it as a finding. ",[155,2178,2179],{},"Never accept new or changed payment details without confirming the request through a separate, trusted channel."," For example, call the supplier using a phone number you already have, not a phone number provided in the email.",[101,2182,2183,2186,2187,2190,2191,211,2194,2197,2198,2201],{},[155,2184,2185],{},"Can one person create and approve payments alone?"," Where separation of duties is not practical, use several compensating controls: ",[155,2188,2189],{},"independent verification"," of new or changed payment details, ",[155,2192,2193],{},"bank transaction limits",[155,2195,2196],{},"payment alerts"," and a ",[155,2199,2200],{},"regular review of payments"," by another owner, director or trusted adviser.",[101,2203,2204,2207],{},[155,2205,2206],{},"Does your banking show information about the recipient before you approve a payment?"," This may include an account-name check, PayID name or Confirmation of Payee result. Make sure whoever pays invoices understands the message,but does not use it as a substitute for independently confirming changed payment details.",[139,2209,2211],{"id":2210},"step-3-backups-and-cloud-systems-30-minutes","Step 3: Backups and cloud systems - 30 minutes",[98,2213,2214,2220,2226,2236],{},[101,2215,2216,2219],{},[155,2217,2218],{},"What is actually backed up?"," Name the systems and information your business could not operate without. Examples may include accounting and payroll records, client files, email, customer databases, contracts, website data, source code, project files, important system settings and more. Confirm that each one is included in the backup, not just \"the computer\".",[101,2221,2222,2225],{},[155,2223,2224],{},"Is one backup copy protected?"," A permanently connected drive or a synchronised folder like OneDrive or Google Drive should not be your only backup. Deleted, encrypted, damaged files or ransomware may be synchronised across devices. Check whether your service offers separate version history or recovery features.",[101,2227,2228,2231,2232,2235],{},[155,2229,2230],{},"Restore one real file now."," Pick any recent document from your backup, restore it and open it. ",[155,2233,2234],{},"This may be the highest-value ten minutes of the whole health check",". A backup that has never been tested is only an assumption. If the restore fails, you have discovered the problem before a real emergency.",[101,2237,2238,2241],{},[155,2239,2240],{},"Critical cloud systems."," List the online services your business relies on. Examples may include accounting, payroll, CRM, website hosting and document storage. Confirm who owns each account, who has administrator access, and what recovery or export options are available.",[139,2243,2245],{"id":2244},"step-4-devices-and-updates-30-minutes","Step 4: Devices and updates - 30 minutes",[98,2247,2248,2254,2260,2266,2272,2278],{},[101,2249,2250,2253],{},[155,2251,2252],{},"Is every work computer and phone supported and automatically updating?"," Check whether the operating system is still receiving updates, and whether automatic updates are on. Put anything that no longer receives security updates on the replacement list - it cannot be protected to the same standard as a supported device.",[101,2255,2256,2259],{},[155,2257,2258],{},"Are laptops encrypted?"," Check whether BitLocker on Windows or FileVault on Mac is turned on.",[101,2261,2262,2265],{},[155,2263,2264],{},"Is computer protection working?"," Check that antivirus or other built-in security protection is turned on and up to date.",[101,2267,2268,2271],{},[155,2269,2270],{},"Do devices lock automatically?"," Make sure computers and phones lock after a short period of inactivity and require a strong password, passcode, PIN or biometric sign-in.",[101,2273,2274,2277],{},[155,2275,2276],{},"Does each person have their own login?"," Ensure that staff do not share accounts and do not use an administrator account for everyday work.",[101,2279,2280,2283],{},[155,2281,2282],{},"Lost phones."," If a phone with company email went missing today, could you wipe it remotely? If you don't know, the answer is no.",[139,2285,2287],{"id":2286},"step-5-people-and-paper-30-minutes","Step 5: People and paper - 30 minutes",[98,2289,2290,2296,2308],{},[101,2291,2292,2295],{},[155,2293,2294],{},"Offboarding checklist."," Is there a written checklist removing a departing employee or contractor’s access to every business system? If not, create one using the user list from Step 1.",[101,2297,2298,2301,2302,2304,2305,2307],{},[155,2299,2300],{},"The two rules for staff."," Make sure everyone who works with email or payments knows these rules:",[169,2303],{},"\n1 - Never approve an MFA prompt you didn't request. Repeated unexpected prompts may mean that someone already has your password.",[169,2306],{},"\n2 - Never change suppliers’ bank details based on an email alone. Confirm the changes by calling a trusted phone number you already have.",[101,2309,2310,2313,2314,2319],{},[155,2311,2312],{},"The incident card."," Print one page with your bank's fraud number, the Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371) - it’s available 24\u002F7, and the ",[104,2315,2318],{"href":2316,"rel":2317},"https:\u002F\u002Fwww.cyber.gov.au\u002Freport-and-recover\u002Fwhere-get-help",[149],"ReportCyber"," web address. Also include your cyber insurer and policy number, IT or incident-response provider, legal or privacy adviser, authorised decision-maker, domain registrar and website host. Keep this card somewhere accessible if your systems are unavailable.",[163,2321,2322],{},[91,2323,2324],{},"If you suspect an active incident, stop the health check and seek professional assistance. Do not delete files, messages or logs that may be evidence. Where safe to do so, disconnect an affected computer from Wi-Fi or the network without wiping or resetting it.",[139,2326,2328],{"id":2327},"step-6-official-checks-and-your-findings-20-minutes","Step 6: Official checks and your findings - 20 minutes",[91,2330,2331,2332,2337],{},"Finish with the Australian government’s free and anonymous ",[104,2333,2336],{"href":2334,"rel":2335},"https:\u002F\u002Fwww.cyber.gov.au\u002Fcyberhealthcheck",[149],"Cyber Health Check Tool",". It takes about five minutes and provides simple, tailored suggestions that you can compare with your findings.",[163,2339,2340],{},[91,2341,2342,2343,2348],{},"For a deeper follow-up with your team, use the ACSC's free ",[104,2344,2347],{"href":2345,"rel":2346},"https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fexercise-in-a-box",[149],"Exercise in a Box",".  It provides practical exercises to help you test how your business would respond to a cyber incident.",[91,2350,2351],{},"Turn your notes into an action plan. Use one row for each finding and four columns:",[953,2353,2354,2378],{},[956,2355,2356],{},[959,2357,2358,2363,2368,2373],{},[962,2359,2360],{},[155,2361,2362],{},"Finding",[962,2364,2365],{},[155,2366,2367],{},"Risk",[962,2369,2370],{},[155,2371,2372],{},"Fix",[962,2374,2375],{},[155,2376,2377],{},"Who \u002F by when",[973,2379,2380],{},[959,2381,2382,2385,2388,2391],{},[978,2383,2384],{},"2 staff accounts do not have MFA",[978,2386,2387],{},"A stolen password could allow someone to access business email",[978,2389,2390],{},"Enforce MFA",[978,2392,2393],{},"Me \u002F Friday",[91,2395,2396,2397,2400],{},"That simple table is the beginning of a practical ",[155,2398,2399],{},"cyber security risk register",". Over time, you can add the severity of the risk, status and date reviewed.",[91,2402,2403,2404,2407],{},"For most small businesses, repeating this ",[155,2405,2406],{},"check every three months"," is a practical starting point. Run it sooner after an employee departure, major system change or suspected incident.",[333,2409,2411],{"id":2410},"prioritise-your-findings-or-what-should-i-fix-first-after-the-health-check","Prioritise your findings, or what should I fix first after the health check?",[91,2413,2414],{},"Deal immediately with any sign of active compromise. Examples may include an unknown administrator, unexplained email forwarding rule, unfamiliar login or unauthorised payment.",[91,2416,2417],{},"For other findings, a practical starting order is:",[1068,2419,2420,2423,2426,2429,2432,2435,2438],{},[101,2421,2422],{},"Protect administrator, email and financial accounts with MFA.",[101,2424,2425],{},"Disable former users who still have access.",[101,2427,2428],{},"Confirm that critical information can be restored from backup.",[101,2430,2431],{},"Strengthen payment verification and approval controls.",[101,2433,2434],{},"Update devices and software.",[101,2436,2437],{},"Replace unsupported devices and software.",[101,2439,2440],{},"Address the remaining findings according to their likely business impact.",[139,2442,2444],{"id":2443},"when-diy-isnt-enough","When DIY isn't enough",[91,2446,2447],{},"This health check can identify common security gaps, but it does not test your systems for technical weaknesses. Seek professional help if there’s a suspected cyber security incident, when important findings remain unfixed, when your business needs technical security testing, or when it holds sensitive or high-risk information such as health records, identity documents, TFNs or financial details.",[91,2449,2450],{},"Most Australian businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but important exceptions apply. For example, some health service providers, businesses that trade in personal information and certain Commonwealth contractors may be covered regardless of turnover.",[91,2452,2453,2454,2459],{},"Check the ",[104,2455,2458],{"href":2456,"rel":2457},"https:\u002F\u002Fwww.oaic.gov.au\u002Fprivacy\u002Fprivacy-guidance-for-organisations-and-government-agencies\u002Forganisations\u002Fsmall-business#section-privacy-checklist-for-small-business",[149],"OAIC’s Small Business Privacy Checklist"," or obtain legal advice if you are unsure whether the Privacy Act applies to your business",[91,2461,2462,2463,2468],{},"When engaging a cyber security provider, ask what framework and assessment method they will use. Depending on your systems and risks, an ",[104,2464,2467],{"href":2465,"rel":2466},"https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fasds-cyber-security-frameworks\u002Fessential-eight",[149],"Essential Eight"," assessment - often beginning with Maturity Level One - may provide a structured and comparable baseline.",[333,2470,2472],{"id":2471},"cant-spare-a-whole-afternoon","Can't spare a whole afternoon?",[91,2474,2475],{},"Do the ten-minute version:",[1068,2477,2478,2481,2484],{},[101,2479,2480],{},"Check that MFA protects the owner's email account.",[101,2482,2483],{},"Explain the payment-verification rule to anyone who pays invoices.",[101,2485,2486],{},"Restore one file from backup.",[2488,2489],"hr",{},[91,2491,2492],{},[2493,2494,2495,2496,2499,2500,343],"em",{},"This article is part of our ",[104,2497,2498],{"href":31},"cyber security for small businesses"," series - including ",[104,2501,2503],{"href":2502},"\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms","why hackers target accounting firms",[2488,2505],{},[139,2507,1373],{"id":1372},[98,2509,2510,2513,2516,2519,2522,2525,2528,2531,2534,2537,2540,2543],{},[101,2511,2512],{},"ASD’s ACSC, Cyber Health Check Tool",[101,2514,2515],{},"ASD’s ACSC, Small Business Cyber Security Guide",[101,2517,2518],{},"ASD’s ACSC, Small Business Hub",[101,2520,2521],{},"ASD’s ACSC, Preventing Business Email Compromise",[101,2523,2524],{},"ASD’s ACSC, Review Your Email Account Security",[101,2526,2527],{},"ASD’s ACSC, Exercise in a Box",[101,2529,2530],{},"ASD’s ACSC, Essential Eight",[101,2532,2533],{},"ASD’s ACSC, Cybercrime - getting help",[101,2535,2536],{},"business.gov.au, Cyber Security Checklist",[101,2538,2539],{},"OAIC, Small Business and the Privacy Act",[101,2541,2542],{},"Microsoft Learn, relevant current MFA administration guidance",[101,2544,2545],{},"Google Workspace Admin Help, relevant 2-Step Verification guidance",{"title":25,"searchDepth":754,"depth":754,"links":2547},[2548,2551,2552,2553,2554,2555,2558,2561],{"id":2069,"depth":754,"text":2070,"children":2549},[2550],{"id":2153,"depth":761,"text":2154},{"id":2164,"depth":754,"text":2165},{"id":2210,"depth":754,"text":2211},{"id":2244,"depth":754,"text":2245},{"id":2286,"depth":754,"text":2287},{"id":2327,"depth":754,"text":2328,"children":2556},[2557],{"id":2410,"depth":761,"text":2411},{"id":2443,"depth":754,"text":2444,"children":2559},[2560],{"id":2471,"depth":761,"text":2472},{"id":1372,"depth":754,"text":1373},"\u002Fcovers\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check.jpg","A practical, jargon-free cyber security checklist you can complete this afternoon to see where your business is exposed - no IT department required.",[2565,2568,2571,2574,2577,2580],{"question":2566,"answer":2567},"Can a small business complete a cyber security health check without an IT provider?","Yes. A business owner or manager can check common risks, including inactive accounts, missing MFA, untested backups, unsupported devices and unsafe payment processes. Please note that a DIY review does not test networks, applications or systems for technical vulnerabilities.",{"question":2569,"answer":2570},"Do I need an IT background to run a cyber security health check?","No. You need admin access to your Microsoft 365 or Google Workspace, your backup system login, and a notepad. Follow the cyber security checklist steps and write down your findings to act on them later.",{"question":2572,"answer":2573},"Is OneDrive or Google Drive a backup?","File synchronisation may help recover earlier files, but a synchronised folder should not be your business’ only backup. Deletions, damaged files or ransomware may be synchronised across devices. Keep a separate protected backup and regularly test that you can restore files from it.",{"question":2575,"answer":2576},"How often should a small business run a cyber security health check?","Every three months is a practical starting point. Run the check sooner if there is a major change, such as a staff departure, the introduction of new software, a change of IT provider or a suspected cyber security incident.",{"question":2578,"answer":2579},"Is there a free government cyber security assessment for small businesses?","Yes. The Cyber Health Check Tool on cyber.gov.au is free and anonymous. It provides tailored suggestions based on your answers. The ACSC's free Exercise in a Box can help your team practice responding to realistic cyber incident scenarios.",{"question":2581,"answer":2582},"When should a business get professional cyber security help?","Seek professional help after a suspected cyber security incident, when important security issues remain unresolved, when a technical testing is required, or when your business holds sensitive or high-risk information, such as health records, identity documents, tax file numbers or financial details. Most Australian small businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but important exceptions apply. Obtain privacy or legal advice if you are unsure whether the Privacy Act applies to your business.",{},{"description":2585,"title":2586},"A plain-English cyber security checklist Australian small businesses can complete themselves, with practical steps and no IT department required.","DIY Cyber Security Health Check for Small Business","Reviewed against current guidance from ASD’s Australian Cyber Security Centre, business.gov.au, the OAIC, Microsoft and Google",{"title":2039,"description":2563},{"loc":37},"cyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check",[48,2592],"Small Business","Nhqi3lLVSDN8wAzFS-1zxT1E-fupXjMiRnQ7gSAcOXw",{"id":2595,"title":2596,"authorBio":2597,"body":2598,"coverImage":3071,"date":1435,"description":3072,"extension":788,"faq":3073,"heroImage":3071,"lastReviewed":86,"meta":3086,"metadata":3087,"navigation":822,"path":2502,"readingTime":3089,"reviewedAgainst":3090,"seo":3091,"sitemap":3092,"stem":3093,"summary":3094,"tags":3095,"thumbnail":3071,"__hash__":3096},"blog\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms.md","Why Hackers Target Accounting Firms and How to Reduce the Risk","Written by Elena Osipova, CPA and emerging cyber security practitioner. Drawing on her accounting and business experience, Elena writes about cyber security governance, real-world incidents and practical security controls for Australian small businesses.",{"type":88,"value":2599,"toc":3059},[2600,2603,2606,2609,2612,2615,2619,2622,2667,2670,2673,2676,2680,2683,2686,2695,2699,2702,2722,2725,2729,2732,2736,2739,2771,2775,2778,2913,2917,2923,2929,2935,2941,2946,2950,3007,3010,3012],[91,2601,2602],{},"In May 2025, the Qilin ransomware group listed Melbourne accounting practice MKA Accountants on its darknet leak site. The group published 12 sample documents it claimed were taken from the firm, including financial statements, insurance information and internal correspondence.",[91,2604,2605],{},"MKA Accountants confirmed that it was investigating unauthorised access and had notified clients and relevant authorities, including the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC). Later reports said Qilin claimed to have released more than 185GB of data, although the exact volume was not independently confirmed.",[91,2607,2608],{},"In May 2026, Brisbane accounting firm Kennedy McLaughlin & Associates confirmed unauthorised access to part of its IT environment after the same ransomware group listed it on their darknet leak site. Cyber Daily reported that a dataset containing client financial details and banking information appeared to have been published. The firm said it had notified affected individuals, the ACSC and the OAIC about this incident.",[91,2610,2611],{},"These were not large organisations. They were local accounting practices - the kind of businesses that hold tax and financial records, payroll and identity document information for many clients.",[91,2613,2614],{},"That set of valuable information is exactly what makes accounting firms attractive targets to cyber criminals.",[139,2616,2618],{"id":2617},"why-accounting-firms-are-valuable-targets","Why accounting firms are valuable targets",[91,2620,2621],{},"Cybercriminals may target an accounting firm for money, but the greater attraction is often the client information and trusted access the firm holds for every client, going back years. This may include:",[98,2623,2624,2629,2634,2639,2645,2651,2656,2661],{},[101,2625,2626],{},[155,2627,2628],{},"Tax file numbers",[101,2630,2631],{},[155,2632,2633],{},"Bank account details",[101,2635,2636],{},[155,2637,2638],{},"Financial statements",[101,2640,2641,2644],{},[155,2642,2643],{},"Payroll data"," such as clients’ employee names, addresses, salaries, bank and superannuation details",[101,2646,2647,2650],{},[155,2648,2649],{},"Identity documents information"," collected for verification",[101,2652,2653],{},[155,2654,2655],{},"Director ID numbers",[101,2657,2658],{},[155,2659,2660],{},"Trust, company and superannuation fund account details",[101,2662,2663,2666],{},[155,2664,2665],{},"Tax and lodgement access information"," like practice-management software, online services for agents, myID-linked access and authorisations that allow staff to act for their clients.",[91,2668,2669],{},"Together, these records can provide enough information for identity theft, tax fraud, and various elaborate, targeted scams.",[91,2671,2672],{},"Accounting and professional service firms are regularly affected by reportable data breaches. In 2025, the OAIC received 1,205 data breach notifications. Legal, accounting and management services accounted for 81 notifications, or approximately 6.7% of the total. This placed the combined sector among the five highest by notification volume.",[91,2674,2675],{},"The information held by accountants for their clients can be used for identity crime, refund fraud and highly convincing scams.",[139,2677,2679],{"id":2678},"what-information-attackers-want","What information attackers want",[91,2681,2682],{},"A stolen TFN isn't just sold once - it's put to work. Cybercriminals have used stolen identities to create fake myGov accounts, link them to real taxpayers' ATO records, then lodge fraudulent tax returns and activity statements and redirect the refunds.",[91,2684,2685],{},"In the two years to February 2023, the ATO cancelled more than 37,000 fraudulent tax returns and business activity statements with a claimed value of $557.8 million. This affected more than 15,000 taxpayers. Some claims were stopped before payment, and the ATO could not attribute the entire amount of claims to a single fraud method.",[91,2687,2688,2689,2694],{},"In February 2024, the ATO said it was defending its websites, services and infrastructure against an average of 4.7 million attempted cyber attacks each month. The ATO maintains the dedicated ",[104,2690,2693],{"href":2691,"rel":2692},"https:\u002F\u002Fwww.ato.gov.au\u002Fonline-services\u002Fscams-cyber-safety-and-identity-protection\u002Fhelp-with-data-breaches\u002Fdata-breach-guidance-for-tax-professionals",[149],"data breach guidance for tax professionals"," so firms can report incidents quickly when client identities, tax information or agent access may have been compromised.",[139,2696,2698],{"id":2697},"how-cyber-attacks-commonly-happen","How cyber attacks commonly happen",[91,2700,2701],{},"Three common attack paths show how a cyber incident may unfold:",[1068,2703,2704,2710,2716],{},[101,2705,2706,2709],{},[155,2707,2708],{},"Phishing and email takeover."," An employee receives a convincing email prompting them to enter their username and password on a fake but look-alike Microsoft 365 login page. The attacker gets the access and reads the mailbox for weeks, downloads client records, and uses the trusted address to send invoice-redirection emails to clients.",[101,2711,2712,2715],{},[155,2713,2714],{},"Ransomware with data theft."," An attacker gains access, quietly copies information, may then encrypt systems before threatening to publish the stolen data. The MKA Accountants and Kennedy McLaughlin & Associates incidents were publicly associated with this type of attack. Paying a ransom does not guarantee that stolen data will be deleted or kept private.",[101,2717,2718,2721],{},[155,2719,2720],{},"Credential theft against practice software and portals."," Stolen logins for practice management systems or lodgement services give cybercriminals the same reach the practice has - across every client at once.",[91,2723,2724],{},"Highly sophisticated hacking is not always required. Many incidents begin with a stolen password, a phishing message, an unpatched system or access that should have been removed.",[139,2726,2728],{"id":2727},"what-a-breach-can-cost","What a breach can cost",[91,2730,2731],{},"In 2024-25, the average self-reported financial loss per cybercrime report from a small business was approximately $56,600, 14% higher than the previous year.",[139,2733,2735],{"id":2734},"legal-and-professional-obligations","Legal and professional obligations",[91,2737,2738],{},"For an accounting practice, stolen money and ransomware demands are only the beginning. A data breach triggers a stack of obligations that most other small businesses never face. These may include:",[98,2740,2741,2747,2753,2759,2765],{},[101,2742,2743,2746],{},[155,2744,2745],{},"Privacy Act and Notifiable Data Breaches scheme."," Many small accounting practices are TFN recipients and may have Privacy Act obligations for the TFN information they hold, even when annual turnover is $3 million or less. They must notify the OAIC and affected individuals when the breach meets the legal test for an eligible data breach, including that it is likely to cause serious harm.",[101,2748,2749,2752],{},[155,2750,2751],{},"Tax Practitioners Board."," Registered tax practitioners must report a significant breach of the Code of Professional Conduct to the TPB within 30 days of when they know, or ought to know that the breach occurred. A cyber incident may trigger this obligation if it involves a significant breach of duties such as client confidentiality or causes, or is likely to cause material loss or damage. Whether reporting is required depends on the circumstances.",[101,2754,2755,2758],{},[155,2756,2757],{},"ATO notification."," Where client identities, TFNs, tax records or agent access may have been compromised, accounting firms should promptly contact the ATO, so it can assess and apply appropriate protections.",[101,2760,2761,2764],{},[155,2762,2763],{},"Professional standards."," Members of professional accounting bodies, such as CPA Australia, may also have confidentiality obligations under APES 110, the Code of Ethics for Professional Accountants. Registered tax practitioners have separate confidentiality obligations under the TPB Code of Professional Conduct. A failure to take reasonable safeguards may also raise professional and ethical issues, depending on the circumstances.",[101,2766,2767,2770],{},[155,2768,2769],{},"Reputational damage and client attrition."," Clients trust their accountants with everything. A public data leak can cause lasting damage to client trust and the firm’s reputation.",[139,2772,2774],{"id":2773},"controls-that-reduce-the-risk","Controls that reduce the risk",[91,2776,2777],{},"The following controls help reduce the risks discussed above. And most of them are low effort.",[953,2779,2780,2799],{},[956,2781,2782],{},[959,2783,2784,2789,2794],{},[962,2785,2786],{},[155,2787,2788],{},"Control",[962,2790,2791],{},[155,2792,2793],{},"Risk it reduces",[962,2795,2796],{},[155,2797,2798],{},"Effort",[973,2800,2801,2812,2822,2833,2843,2853,2863,2873,2883,2893,2903],{},[959,2802,2803,2806,2809],{},[978,2804,2805],{},"MFA on email, practice software and tax-related accounts",[978,2807,2808],{},"Account takeover after password theft",[978,2810,2811],{},"Low",[959,2813,2814,2817,2820],{},[978,2815,2816],{},"Password manager and strong, unique passwords",[978,2818,2819],{},"Password reuse and credential-stuffing attacks",[978,2821,2811],{},[959,2823,2824,2827,2830],{},[978,2825,2826],{},"Protected backup copy",[978,2828,2829],{},"Loss of all recoverable copies during ransomware",[978,2831,2832],{},"Medium",[959,2834,2835,2838,2841],{},[978,2836,2837],{},"Segregation of payment duties and independent verification of changed payment details",[978,2839,2840],{},"Invoice and payment-redirection fraud",[978,2842,2811],{},[959,2844,2845,2848,2851],{},[978,2846,2847],{},"Practical staff training on phishing, unexpected MFA prompts and payment changes",[978,2849,2850],{},"Staff responding to phishing, unexpected MFA prompts and approving fake payment requests",[978,2852,2811],{},[959,2854,2855,2858,2861],{},[978,2856,2857],{},"Automatic security updates on operating systems and practice software",[978,2859,2860],{},"Exploitation of known vulnerabilities in unpatched software",[978,2862,2811],{},[959,2864,2865,2868,2871],{},[978,2866,2867],{},"Regular access reviews and offboarding checklist for staff",[978,2869,2870],{},"Unnecessary access and active former-staff access",[978,2872,2811],{},[959,2874,2875,2878,2881],{},[978,2876,2877],{},"Regular review of third-party, contractor and connected-app access",[978,2879,2880],{},"Unnecessary access by old providers, contractors or connected apps",[978,2882,2832],{},[959,2884,2885,2888,2891],{},[978,2886,2887],{},"Sign-in and administrator alerts",[978,2889,2890],{},"Undetected misuse of compromised accounts",[978,2892,2832],{},[959,2894,2895,2898,2901],{},[978,2896,2897],{},"Data retention and secure deletion",[978,2899,2900],{},"Unnecessary exposure of old client records and identity documents",[978,2902,2832],{},[959,2904,2905,2908,2911],{},[978,2906,2907],{},"Tested incident-response plan",[978,2909,2910],{},"Delayed containment and missed reporting steps",[978,2912,2832],{},[333,2914,2916],{"id":2915},"four-controls-worth-a-closer-look","Four controls worth a closer look",[91,2918,2919,2922],{},[155,2920,2921],{},"Review what you keep."," Retain records for the periods required by law and professional standards, but securely delete duplicate files, outdated identity documents and other information when there is no longer legal, professional or business reason to keep it. Holding less unnecessary information reduces the potential impact of a breach.",[91,2924,2925,2928],{},[155,2926,2927],{},"Review connected services."," Check which cloud platforms, software integrations, contractors and service providers can access client information. Remove unused and unnecessary connections, confirm who has administrator access and understand how each provider protects and backs up your data.",[91,2930,2931,2934],{},[155,2932,2933],{},"Train staff on real warning signs."," Make sure employees know how to recognise suspicious login pages, unexpected MFA prompts and urgent payment requests. They should know who to contact and what to do before clicking, approving a prompt or making a payment.",[91,2936,2937,2940],{},[155,2938,2939],{},"Protect at least one backup copy."," Keep one backup offline, immutable or otherwise protected from normal user accounts and devices. Test regularly that important files can be restored from it.",[91,2942,1365,2943,2945],{},[104,2944,1368],{"href":37}," for a structured review of your accounts, payments, backups, devices and business processes.",[139,2947,2949],{"id":2948},"five-actions-to-take-this-week","Five actions to take this week",[1068,2951,2952,2958,2977,2983,2989],{},[101,2953,2954,2957],{},[155,2955,2956],{},"Turn on MFA"," for every supported business account, beginning with email, administrator, financial and tax-related accounts. Where available, use phishing-resistant methods like passkeys or security keys.",[101,2959,2960,2963],{},[155,2961,2962],{},"Give staff two clear rules:",[1068,2964,2965,2971],{},[101,2966,2967,2970],{},[155,2968,2969],{},"Never approve an MFA prompt they did not request",". An unexpected prompt may mean someone is trying to access the account.",[101,2972,2973,2976],{},[155,2974,2975],{},"Never change payment details based on an email alone",". Confirm the request by calling a trusted phone number already held by the firm.",[101,2978,2979,2982],{},[155,2980,2981],{},"Enable automatic security updates where supported."," Keep computers, servers, browsers, practice software, remote access tools and internet-facing devices protected against known vulnerabilities.",[101,2984,2985,2988],{},[155,2986,2987],{},"Review your user list."," Check every account and access role. Promptly disable accounts belonging to former staff. Treat any unknown or suspicious account as urgent.",[101,2990,2991,2994,2995,2998,2999,3002,3003,3006],{},[155,2992,2993],{},"Print your incident contacts."," Include the ATO's ",[104,2996,2693],{"href":2691,"rel":2997},[149],", the OAIC, the TPB, ",[104,3000,2318],{"href":2316,"rel":3001},[149]," and the Australian Cyber Security Hotline ",[155,3004,3005],{},"1300 CYBER1 (1300 292 371)",". You should also include your IT or incident-response provider; cyber insurer and policy number; legal or privacy adviser; authorised decision-maker.",[91,3008,3009],{},"Cybercriminals target accounting firms because the information and access they hold can be highly valuable. The good news is that you can strengthen your defences  with basic, consistent controls to make many common attack paths much harder.",[139,3011,1373],{"id":1372},[98,3013,3014,3017,3020,3023,3026,3029,3032,3035,3038,3041,3044,3047,3050,3053,3056],{},[101,3015,3016],{},"ASD, Annual Cyber Threat Report 2024-25",[101,3018,3019],{},"OAIC, Data breach notifications increase to all-time high in 2025",[101,3021,3022],{},"OAIC, Quick reference guide for responding to data breaches",[101,3024,3025],{},"OAIC, The Privacy (Tax File Number) Rule 2015 and the protection of TFN information",[101,3027,3028],{},"ATO, Agent checklist for client-to-agent linking process",[101,3030,3031],{},"ATO, Accessing Online services for agents",[101,3033,3034],{},"ATO, Data breach guidance for tax professionals",[101,3036,3037],{},"Australian Government, Privacy (Tax File Number) Rule 2015",[101,3039,3040],{},"TPB, Breach reporting obligations;",[101,3042,3043],{},"TPB, Protect your practice from cyber-attacks",[101,3045,3046],{},"TPB, Debunking myths about breach reporting",[101,3048,3049],{},"iTnews, ATO attackers filed $557 million in false claims",[101,3051,3052],{},"Cyber Daily, MKA Accountants confirms Qilin ransomware attack",[101,3054,3055],{},"Cyber Daily, Kennedy McLaughlin confirms cyber incident",[101,3057,3058],{},"ABC, Outgoing ATO boss says getting rid of work-related tax deductions would be a 'big step'",{"title":25,"searchDepth":754,"depth":754,"links":3060},[3061,3062,3063,3064,3065,3066,3069,3070],{"id":2617,"depth":754,"text":2618},{"id":2678,"depth":754,"text":2679},{"id":2697,"depth":754,"text":2698},{"id":2727,"depth":754,"text":2728},{"id":2734,"depth":754,"text":2735},{"id":2773,"depth":754,"text":2774,"children":3067},[3068],{"id":2915,"depth":761,"text":2916},{"id":2948,"depth":754,"text":2949},{"id":1372,"depth":754,"text":1373},"\u002Fcovers\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms.jpg","Learn why accounting firms attract cybercriminals and the practical steps small practices can take to protect client data and reduce cyber risk.",[3074,3077,3080,3083],{"question":3075,"answer":3076},"Why would hackers target a small accounting firm instead of a big company","A small accounting firm may hold the same kinds of valuable client information as a big company, including TFNs, payroll records, bank details and identity documents. At the same time, smaller firms may have fewer dedicated IT and security resources. This combination can make them attractive to cybercriminals.",{"question":3078,"answer":3079},"Does the Privacy Act apply to my accounting practice if turnover is under $3 million?","Under the Privacy (Tax File Number) Rule 2015, many accounting practices with annual turnover of $3 million or less still have Privacy Act obligations because they receive and hold TFN information. If a breach is likely to cause serious harm, the practice may need to notify the OAIC and affected individuals under the Notifiable Data Breaches scheme. Other Privacy Act exceptions may also apply. Obtain legal or privacy advice for your circumstances.",{"question":3081,"answer":3082},"What is the single most effective protection for an accounting firm?","Multi-factor authentication (MFA) is one of the most important protections for administrator, email, practice management software and tax-related accounts. It adds another layer of protection when a password is stolen or phished.",{"question":3084,"answer":3085},"What should an accounting firm do immediately after discovering a data breach?","Where safe and appropriate, disconnect an affected computer from Wi-Fi or the network without wiping or resetting it, and seek qualified IT or incident-response support. Contact the ATO promptly if client tax information or agent access may be affected. The firm should then assess its notification obligations. These may include notifying the OAIC and affected individuals under the Notifiable Data Breaches scheme, the TPB where a significant Code of Professional Conduct breach may have occurred; professional associations, insurers, and other affected parties",{},{"description":3072,"title":3088},"Why Hackers Target Accounting Firms & How to Reduce the Risk",9,"Reviewed against current guidance from ASD’s Australian Cyber Security Centre, the OAIC, business.gov.au, the ATO and TPB",{"title":2596,"description":3072},{"loc":2502},"cyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms","Accounting firms hold the keys to their clients' finances - which is exactly why they're such an attractive target for cybercriminals. Here's what makes them vulnerable, and how to close the cyber security gaps.",[48,2592],"JKrfW2SpuQSHKmIm97ylyA-qvnCXZppsJchpqGZpN5c",1785204198126]