[{"data":1,"prerenderedAt":3693},["ShallowReactive",2],{"navigation":3,"socials":68,"post-\u002Fthe-ultimate-guide-to-increase-ecommerce-conversion-rates":83,"post-related":1429},{"id":4,"extension":5,"footer":6,"header":56,"meta":65,"stem":66,"__hash__":67},"navigation\u002Fnavigation.yml","yml",[7,26,38],{"label":8,"items":9,"path":25},"Web development",[10,13,16,19,22],{"label":11,"path":12},"Vue web development","\u002Fvue-js-development-services",{"label":14,"path":15},"React development services","\u002Freact-js-development-services",{"label":17,"path":18},"Laravel development services","\u002Flaravel-development-services",{"label":20,"path":21},"Shopify developers Melbourne","\u002Fshopify",{"label":23,"path":24},"Next.js developers Melbourne","\u002Fnext-js-framework","",{"label":27,"items":28,"path":25},"Cyber security",[29,32,35],{"label":30,"path":31},"Cyber security for small business","\u002Fcyber-security\u002Fsmall-business",{"label":33,"path":34},"Lessons from famous breaches","\u002Fcyber-security\u002Fbreach-lessons",{"label":36,"path":37},"Free cyber health check","\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check",{"label":39,"items":40},"Navigate",[41,44,47,50,53],{"label":42,"path":43},"Home","\u002F",{"label":45,"path":46},"Case Studies","\u002Fcase-studies",{"label":48,"path":49},"Cyber Security","\u002Fcyber-security",{"label":51,"path":52},"Contact Us","\u002Fcontact",{"label":54,"path":55},"Editorial Policy","\u002Feditorial-policy",[57,60,61,62],{"label":58,"path":59},"Web Development","\u002Fweb-development",{"label":45,"path":46},{"label":48,"path":49},{"label":63,"path":64},"About","\u002Fabout",{},"navigation","vaEm85Hrq3ctMNbTgmkywbdLEBklhE1-5zsuR9ZI5Oo",{"id":69,"extension":5,"items":70,"meta":80,"stem":81,"__hash__":82},"socials\u002Fsocials.yml",[71,74,77],{"type":72,"link":73},"facebook","https:\u002F\u002Fwww.facebook.com\u002Fitclub.com.au",{"type":75,"link":76},"linkedin","https:\u002F\u002Fwww.linkedin.com\u002Fcompany\u002Fitclub\u002Fabout\u002F",{"type":78,"link":79},"behance","https:\u002F\u002Fwww.behance.net\u002Felenaitclub\u002F",{},"socials","R3zh7G2Yeky6IFraIEG2izmfHXa3EG7r0rHl4YbjpWk",{"id":84,"title":85,"authorBio":86,"body":87,"coverImage":1399,"date":1400,"description":1401,"extension":1402,"faq":1403,"heroImage":86,"lastReviewed":86,"meta":1416,"metadata":1417,"navigation":1418,"path":1419,"readingTime":86,"reviewedAgainst":86,"seo":1420,"sitemap":1421,"stem":1422,"summary":1423,"tags":1424,"thumbnail":1399,"__hash__":1428},"blog\u002Fweb-development\u002Fecommerce-conversion-rates.md","The Ultimate Guide to Increase E-commerce Conversion Rates",null,{"type":88,"value":89,"toc":1376},"minimark",[90,94,110,121,137,140,143,187,191,198,205,208,214,216,219,222,239,244,251,256,258,266,273,280,287,290,292,295,298,303,306,317,328,390,406,409,412,415,417,421,429,440,451,459,474,491,493,496,507,515,518,526,535,543,558,561,564,566,569,582,593,604,615,625,633,635,638,649,656,664,670,676,683,693,703,710,712,715,722,735,737,740,747,770,773,783,794,796,799,806,813,818,827,830,838,845,859,861,864,871,876,881,887,903,910,915,922,933,941,943,946,957,968,971,974,982,984,987,990,998,1006,1008,1011,1014,1016,1024,1026,1028,1032,1035,1049,1051,1055,1066,1073,1108,1114,1143,1148,1150,1154,1165,1171,1204,1210,1256,1261,1263,1266,1280,1282,1284,1291,1293,1295,1309,1311,1313,1317,1372,1374],[91,92,93],"p",{},"Many would agree that an outstanding user experience attracts visitors and improves the effectiveness of any e-commerce website. In this article, you will find everything you need to know on how to increase your online store conversion.",[91,95,96,97,104,105,109],{},"To begin with, let’s look at the average e-commerce conversion rates in 2020. According to the ",[98,99,103],"a",{"href":100,"rel":101},"https:\u002F\u002Fwww.slideshare.net\u002Fadobe\u002Fadi-consumer-electronics-report-2020?from_action=save",[102],"nofollow","Adobe Consumer Electronics Report 2020",", the ",[106,107,108],"strong",{},"average conversion rate among various industries is about 3.0%",". Based on this report, the highest conversion rates have been achieved in cases where consumers are looking for something with the intent to buy that item or service, for example, Gifts, Health and Pharmacy, and Apparel and Footwear.",[91,111,112,117,118],{},[113,114],"img",{"alt":115,"src":116,"title":115},"Average conversion and average order value, according to Adobe Consumer Electronics Report 2020","\u002Fuploads\u002FConversion_Adobe_report.jpg"," ",[119,120],"br",{},[91,122,123,124,104,131,136],{},"In regards to ",[106,125,126],{},[98,127,130],{"href":128,"rel":129},"https:\u002F\u002Fitclub.com.au\u002Fshopify",[102],"Shopify stores",[98,132,135],{"href":133,"rel":134},"https:\u002F\u002Fblog.littledata.io\u002F2019\u002F06\u002F14\u002F6-essential-benchmarks-for-shopify-stores\u002F",[102],"benchmark"," e-commerce conversion rate is around 1.75%, with larger stores having about 1.85%. Shopify stores in the top quartile achieve conversion rates of over 2.8%, with the highest rate at 8%.",[91,138,139],{},"Therefore, if you are not satisfied with the current conversion rate of your e-commerce site, the tips below can help you detect areas for improvements to increase conversion.",[91,141,142],{},"Feel free to navigate to any item in the list by hitting their respective links below:",[144,145,146,153,159,165,171,177],"ul",{},[147,148,149],"li",{},[98,150,152],{"href":151},"#what-are-the-best-colours-for-conversion","What are the best colours for conversion?",[147,154,155],{},[98,156,158],{"href":157},"#how-many-products-to-display-to-increase-conversion","How many products to display to increase conversion?",[147,160,161],{},[98,162,164],{"href":163},"#understanding-customers-needs-to-optimise-conversion","Understanding customers’ needs to optimise conversion",[147,166,167],{},[98,168,170],{"href":169},"#considered-vs-impulse-purchases","Considered vs Impulse purchases",[147,172,173],{},[98,174,176],{"href":175},"#resources-and-appreciations","Resources and Appreciations",[147,178,179,117,183,185],{},[98,180,182],{"href":181},"#frequently-asked-questions","Frequently Asked Questions",[119,184],{},[119,186],{},[188,189,152],"h2",{"id":190},"what-are-the-best-colours-for-conversion",[91,192,193,194,197],{},"When you have an ",[106,195,196],{},"established brand",", there is not much freedom for choice as you have to stick to the colour palette that has already been determined. Nevertheless, when it comes to improving the conversion of your online store, you might need to deviate from your existing colours.",[91,199,200,201,204],{},"The question is ",[106,202,203],{},"what colour converts best","? Unfortunately, no one solution fits all, and the answer always comes down to A\u002FB testing.",[91,206,207],{},"This is all about finding the balance between what fits with your brand and what gives high conversion rates. Moreover, until you have a 100% click-through rate, there will always be A\u002FB testing to run.",[209,210,211],"blockquote",{},[91,212,213],{},"Please take into account that, when you make any changes to your existing website, you should only make one change at a time so that you will see exactly what works and what doesn’t.",[119,215],{},[188,217,158],{"id":218},"how-many-products-to-display-to-increase-conversion",[91,220,221],{},"You may wonder how many products you should display per page to increase conversion for your online store. It can be tempting to display all your products on a page and expect your customers to be attracted to the many options they see. If this were the case, most e-commerce stores would have no problems with conversion.",[91,223,224,225,230,231,234,235,238],{},"Although having lots of choices might appear desirable, ",[98,226,229],{"href":227,"rel":228},"https:\u002F\u002Fwww.researchgate.net\u002Fpublication\u002F12189991_When_Choice_is_Demotivating_Can_One_Desire_Too_Much_of_a_Good_Thing",[102],"research"," has shown that customers become ",[106,232,233],{},"disoriented"," and ",[106,236,237],{},"unmotivated"," when there are too many choices available. This became apparent when the inclination to make a purchase was compared between a 24-flavour and 6-flavour display of jam.",[209,240,241],{},[91,242,243],{},"According to this study, when consumers saw 24 different flavours of jam, on average, 1.5 flavours were sampled. On the other hand, at the 6-flavour display, an average of 1.38 flavours was tested.",[209,245,246],{},[91,247,248],{},[106,249,250],{},"In both cases, customers sampled no more than two different flavours.",[209,252,253],{},[91,254,255],{},"Furthermore, nearly 30% of the consumers with fewer choices subsequently made a purchase, while in comparison, at the 24-flavour display, only 3% of the consumers purchased jam.",[119,257],{},[91,259,260,117,264],{},[113,261],{"alt":262,"src":263,"title":262},"How many products to display to increase conversion. When choice is demotivating","\u002Fuploads\u002FConversion_experiment.jpg",[119,265],{},[91,267,268,269,272],{},"This makes it clear that abundance can create, what is called, ",[106,270,271],{},"choice paralysis",", meaning that customers may struggle to make a decision, which can, in some cases, lead to dissatisfaction when a decision is made, as the customer starts thinking about the missed choices.",[91,274,275,276,279],{},"Therefore, you need to ",[106,277,278],{},"keep it simple when designing layouts for your online store",". If you want to increase conversion, start to offer fewer products per page, helping your customers avoid an unpleasant experience, and boosting your sales.",[91,281,282,283,286],{},"Also, make sure that you have a ",[106,284,285],{},"reduced amount of calls to action"," or fewer options and places your users need to click. This will avoid confusion and help drive sales. Make it clear for your visitors on what to do, so it will be easier for them to choose and buy your product.",[91,288,289],{},"Simply put, less choice equals more sales.",[119,291],{},[188,293,164],{"id":294},"understanding-customers-needs-to-optimise-conversion",[91,296,297],{},"The most crucial aspect of user experience is to understand what your customers want.",[209,299,300],{},[91,301,302],{},"Research helps you learn more about your customers’ needs and behaviour.",[91,304,305],{},"Usually, this can be done by way of speaking with a few of your customers (I’d say up to ten people) and watching how they interact with your online store as well as with some of your competitors’ stores. This can give you valuable insights and help understand the importance of particular product page elements to improve them for your customers’ use.",[91,307,308,309,312,313,316],{},"In addition, I would suggest paying more attention to the ",[106,310,311],{},"product page",". This is the section of your e-commerce site that is ",[106,314,315],{},"most critical for conversion"," and to sell your product or service. It is vital to understand and meet your customers' needs to make a product page that converts. This makes the intuitive user experience extremely important.",[91,318,319,320,323,324,327],{},"Here are the ",[106,321,322],{},"elements"," that would be ",[106,325,326],{},"relevant to any product pages"," and which you might want to check and improve on your online store:",[144,329,330,336,342,348,354,360,366,372,378,384],{},[147,331,332],{},[98,333,335],{"href":334},"#product-image","Product Image",[147,337,338],{},[98,339,341],{"href":340},"#additional-product-images-and-video","Additional Product Images and Video",[147,343,344],{},[98,345,347],{"href":346},"#product-title","Product Title",[147,349,350],{},[98,351,353],{"href":352},"#add-to-cart-button","Add to Cart Button",[147,355,356],{},[98,357,359],{"href":358},"#price","Price",[147,361,362],{},[98,363,365],{"href":364},"#product-description","Product Description",[147,367,368],{},[98,369,371],{"href":370},"#delivery-options","Delivery Options",[147,373,374],{},[98,375,377],{"href":376},"#product-reviews","Product Reviews",[147,379,380],{},[98,381,383],{"href":382},"#detailed-product-specification","Detailed Product Specification",[147,385,386],{},[98,387,389],{"href":388},"#returns-and-refunds","Returns and Refunds",[91,391,392,393,234,396,399,400,405],{},"It would be useful to ",[106,394,395],{},"list",[106,397,398],{},"rank"," these elements ",[98,401,404],{"href":402,"rel":403},"https:\u002F\u002Fwww.shopify.com.au\u002Fpartners\u002Fblog\u002F61771331-the-top-ux-elements-to-optimize-your-clients-product-page-design",[102],"in order of their importance"," to help meet your users’ needs and make the design much more intuitive and streamlined. When you go through your ranking exercise, place those options in the hierarchy that matches your users’ needs, rather than considering your own choice.",[91,407,408],{},"Also, if you sell several different types of products, you might want to consider optimising the user experience of every distinctive type of product you sell.",[91,410,411],{},"Designing a product page using this approach will not only help streamline your design process but will eventually improve the overall user experience within your e-commerce store.",[91,413,414],{},"Now, let’s discuss every element of the product page in detail, to boost conversion of your e-commerce store.",[119,416],{},[418,419,335],"h3",{"id":420},"product-image",[209,422,423],{},[91,424,425,426,428],{},"One look is worth a thousand words.",[119,427],{}," -Frederick R. Barnard",[91,430,431,432,435,436,439],{},"The ",[106,433,434],{},"product image"," is an essential element of the page. It ",[106,437,438],{},"does all the hard work"," for you, as it sells the item. A product image helps visitors get excited about your product. That’s why those product images that convey how the product makes your customers feel, and how it can make their lives better, will always convert visitors into customers.",[209,441,442],{},[91,443,444,445,450],{},"67% of online shoppers believe that ",[98,446,449],{"href":447,"rel":448},"http:\u002F\u002Ftheultralinx.com\u002F2013\u002F06\u002Fimpact-images-social-media-infographic\u002F",[102],"images are vital"," when making a purchasing decision, with 63% of consumers saying that good images are more important than product descriptions.",[91,452,453,117,457],{},[113,454],{"alt":455,"src":456,"title":455},"Product image on the product page. The Berry Twist Club by Bite example","\u002Fuploads\u002FConversion_bite.jpg",[119,458],{},[91,460,461,462,473],{},"Your product image needs to address ",[98,463,465,466,469,470],{"href":402,"rel":464},[102],"the ",[106,467,468],{},"emotional feel"," and the ",[106,471,472],{},"rational utility"," of your product, in order to convert. Thus, let your customers zoom in on specific details of your product, watch a video, and imagine themselves with the product as they look at their screen.",[91,475,476,477,234,480,483,484,234,487,490],{},"Want your image to be compelling? Make it ",[106,478,479],{},"big",[106,481,482],{},"high quality",", ",[106,485,486],{},"unique",[106,488,489],{},"stand out"," from your competitors. This is especially important for stores that sell products where consumers can be concerned with every little detail.",[119,492],{},[418,494,341],{"id":495},"additional-product-images-and-video",[91,497,498,499,502,503,506],{},"The rule here is the ",[106,500,501],{},"more product images"," you have on your product page, ",[106,504,505],{},"the better",".",[209,508,509],{},[91,510,511,512,506],{},"It is essential to show all sides of the product by taking practical shots that ",[106,513,514],{},"showcase all the details and features",[91,516,517],{},"Don’t forget to appeal to both the emotional and rational decision-making of your visitors. Let your additional product images and video content get the hard work done and sell your product.",[91,519,520,117,524],{},[113,521],{"alt":522,"src":523,"title":522},"Additional product images and video on the product page. The Sephora example","\u002Fuploads\u002FConversion_Sephora_zoom.jpg",[119,525],{},[91,527,528,529,534],{},"Moreover, feature products in context. According to Google, ",[98,530,533],{"href":531,"rel":532},"https:\u002F\u002Fwww.thinkwithgoogle.com\u002Fmarketing-resources\u002Fmicro-moments\u002Fcomparison-shopping-mobile\u002F",[102],"64% of women"," who shop for apparel on their smartphones say that images of products in context positively influence their purchase decision.",[91,536,537,117,541],{},[113,538],{"alt":539,"src":540,"title":539},"64% of women who shop for apparel on their smartphones say that images influence their purchase decision","\u002Fuploads\u002FConversion_Google.jpg",[119,542],{},[91,544,545,546,551,552,557],{},"Also, ",[98,547,550],{"href":548,"rel":549},"https:\u002F\u002Fimages.fastcompany.net\u002Fimage\u002Fupload\u002Fw_596,c_limit,q_auto:best,f_auto\u002Ffc\u002F3035856-inline-i-1-visualworld.jpg",[102],"90% of online shoppers"," find videos helpful in making decisions about purchasing a product. Moreover, online shoppers who view video are ",[98,553,556],{"href":554,"rel":555},"https:\u002F\u002Ftheblog.adobe.com\u002Fseo-for-success-in-video-marketing\u002F",[102],"1.81X more likely to purchase"," than non-viewers.",[91,559,560],{},"Get the best results out of the gallery photos of your product by using images associated with the product details that you highlighted in the product description - for example, the comfort, quality and feature elements.",[91,562,563],{},"Don’t forget to label every image with a relevant description to highlight, one more time, the quality of your product, as well as the Alt text that is essential for SEO purposes.",[119,565],{},[418,567,347],{"id":568},"product-title",[91,570,571,572,574,575,234,578,581],{},"Let it be ",[106,573,486],{}," and in a ",[106,576,577],{},"bold",[106,579,580],{},"easy-to-read"," typeface. You can hit your visitors’ emotional buttons by merely adding in a concise description of the product within its title, as long as it is not more than 60-70 characters long.",[91,583,584,585,588,589,592],{},"This trick can also work for SEO purposes and boost your credibility when users start shopping around and googling the product name to compare the prices with competitors. If they are searching using your ",[106,586,587],{},"unique product name",", you should ",[106,590,591],{},"appear first in the search results",", which gives you more discoverability and credibility with users, even if your product is not the cheapest option.",[209,594,595],{},[91,596,597,598,603],{},"According to ",[98,599,602],{"href":600,"rel":601},"https:\u002F\u002Fwww.searchenginewatch.com\u002F2011\u002F04\u002F21\u002Ftop-google-result-gets-36-4-of-clicks-study\u002F",[102],"Search Engine Watch report"," and a research study by Optify, the top-ranked websites on Google receive the following average click-through rates (CTR):",[144,605,606,609,612],{},[147,607,608],{},"#1: CTR = 36.4%;",[147,610,611],{},"#2: CTR = 12.5%",[147,613,614],{},"#3: CTR = 9.5%.",[209,616,617],{},[91,618,597,619,624],{},[98,620,623],{"href":621,"rel":622},"https:\u002F\u002Fmarketingland.com\u002Fgoogle-results-position-how-much-is-first-place-really-worth-19412",[102],"Gabe Donnini",", the share of impressions coming from the first position on Google is double the performance of the second position.",[91,626,627,117,631],{},[113,628],{"alt":629,"src":630,"title":629},"Product title on the product page. The Sportscraft example","\u002Fuploads\u002FConversion_sportscraft.jpg",[119,632],{},[119,634],{},[418,636,353],{"id":637},"add-to-cart-button",[91,639,640,641,644,645,648],{},"Make the ",[106,642,643],{},"Buy Now"," \u002F ",[106,646,647],{},"Add to Cart"," button stand out. Don’t use fancy words to avoid confusing users.",[91,650,651,652,655],{},"You can give it a unique colour not used anywhere else on the page, or make it bigger and the text bolder. In other words, the Buy Now \u002F Add to Cart button ",[106,653,654],{},"needs to stand out"," on the page.",[91,657,658,117,662],{},[113,659],{"alt":660,"src":661,"title":660},"Add to Cart Button on the product page. The Crutchfield example","\u002Fuploads\u002FConversion_crutchfield.jpg",[119,663],{},[91,665,666,667,669],{},"Are you selling one item per transaction? No worries. Use the ",[106,668,643],{}," button. In this case, clicking on this button should redirect the user to the cart page with the item added so they can purchase the product.",[91,671,672,673,675],{},"Are you selling multiple items per transaction? Use the ",[106,674,647],{}," button to allow users to continue shopping. After the user hits the Add to Cart button, offer them a choice to go to the Cart or to continue shopping.",[91,677,678,679,682],{},"Another option for the ",[106,680,681],{},"call to action (CTA) buttons"," to keep in mind is related to Fitts’ Law.",[209,684,685],{},[91,686,597,687,692],{},[98,688,691],{"href":689,"rel":690},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FFitts%27s_law",[102],"Fitts's Law",", targets a user has to hit (CTA buttons and the Buy button, in our case) have to be as big as possible, meaning that they need to be optimised so that there is a high chance of the user clicking the target.",[91,694,695,696,699,700,702],{},"The Product page would convert at a higher rate when the ",[106,697,698],{},"Quantity"," selector\u002Fdropdown and the ",[106,701,643],{}," button are put close to each other, and the latter should not be smaller in size. This little tweak in design on the product page can play a significant role in driving more sales.",[91,704,705,706,709],{},"Fitts’ Law is also relevant for the mobile version of your e-commerce store where you need to keep the Buy Now button ",[106,707,708],{},"easy to reach"," for your users.",[119,711],{},[418,713,359],{"id":714},"price",[91,716,717,718,721],{},"How does your product differentiate from your competition? If you are selling the ",[106,719,720],{},"same product"," as many of your competitors, then make the price bigger size on the page.",[91,723,724,725,728,729,234,731,734],{},"Does your ",[106,726,727],{},"product"," have ",[106,730,486],{},[106,732,733],{},"exceptional qualities"," or related services (e.g. personalisation, environmentally-friendly, fast delivery, etc.)? Then sell the benefits that your products will bring to your customer using the emotional feel and by reducing the display emphasis on price.",[119,736],{},[418,738,365],{"id":739},"product-description",[91,741,742,743,746],{},"Make your ",[106,744,745],{},"product description"," speak to both the emotional and rational decision-making processes of the buyer. The product description needs to cover:",[144,748,749,752,763],{},[147,750,751],{},"what the product does",[147,753,754,755,758,759,762],{},"how it ",[106,756,757],{},"makes"," your user ",[106,760,761],{},"feel",", and",[147,764,765,766,769],{},"how it will ",[106,767,768],{},"make life better"," for your user if they have it.",[91,771,772],{},"Don’t limit yourself on flattering and emotional language. Let your customers know how they will feel and how their life will become better if they make this purchase.",[91,774,775,117,779,781],{},[113,776],{"alt":777,"src":778,"title":777},"Product image and Product Description on the product page. The Net-a-porter example","\u002Fuploads\u002FConversion_Net-a-porter.jpg",[119,780],{},[119,782],{},[91,784,785,786,789,790,793],{},"Don’t rely on the default description provided by your supplier or manufacturer. Instead, ",[106,787,788],{},"write"," the product features ",[106,791,792],{},"yourself",". This is a win-win decision as it can also improve your on-page SEO, due to additional keywords that you can integrate into your product description.",[119,795],{},[418,797,371],{"id":798},"delivery-options",[91,800,801,802,805],{},"Do you know one of ",[106,803,804],{},"the biggest reasons for abandoned shopping carts"," in online stores?",[91,807,808,809,812],{},"It is ",[106,810,811],{},"the lack of information"," about delivery options and delivery-associated costs on the product page. By including these details on the product page, you appeal to the rational and emotional decision-making of your buyers.",[209,814,815],{},[91,816,817],{},"Shipping is a real pain point for many buyers.",[91,819,820,821,826],{},"According to research, ",[98,822,825],{"href":823,"rel":824},"https:\u002F\u002Fwww.bigcommerce.com.au\u002Fblog\u002Fconsumer-behavior-infographic\u002F#is-it-that-shoppers-arent-shopping",[102],"58% of online shoppers"," say that shipping costs are likely to stop them from buying, with 34% of consumers refusing to buy when they need to wait a long time for delivery.",[91,828,829],{},"Offer an excellent shipping service to your customers, and they will choose your products over your competitors.",[91,831,832,117,836],{},[113,833],{"alt":834,"src":835,"title":834},"Shipping and delivery options on the product page. The Koala example","\u002Fuploads\u002FConversion_koala_delivery_images.jpg",[119,837],{},[91,839,840,841,844],{},"The ideal situation is that you offer a ",[106,842,843],{},"free delivery"," option, and fast delivery at a premium cost.",[91,846,847,848,234,851,854,855,858],{},"Also, if you sell ",[106,849,850],{},"low-cost",[106,852,853],{},"impulse purchases",", make an emphasis on ",[106,856,857],{},"shipping speed",". These customers want to get their purchases as quickly as possible as not to further doubt their spending decision.",[119,860],{},[418,862,377],{"id":863},"product-reviews",[91,865,866,867,870],{},"It’s not new that others’ opinions and ",[106,868,869],{},"social proof"," can significantly influence customers' decision-making.",[209,872,873],{},[91,874,875],{},"Social proof is also called informational social influence, meaning that individuals assume that the actions of other people are the correct course to take.",[209,877,878],{},[91,879,880],{},"The fact that one person tried a product, liked it and shared their positive experience, represents proof of the product’s high quality and is a good reason for another individual to try it too.",[91,882,883,886],{},[106,884,885],{},"Customer Reviews"," are used in two different ways by users:",[144,888,889,896],{},[147,890,891,892,895],{},"Reviews are used to ",[106,893,894],{},"assess the quality"," of the product and your service and reassure themselves that what you say on the rest of the page is valid.",[147,897,898,899,902],{},"Customer Reviews help find out about ",[106,900,901],{},"additional features"," of the product that might not be listed on the page.",[91,904,905,906,909],{},"Thus, if you can provide a comprehensive set of reviews, they will ",[106,907,908],{},"add credibility"," to your product page and help sell your product. Don’t aim for overly positive reviews, though, as it is likely to lead to visitors questioning their accuracy and validity.",[209,911,912],{},[91,913,914],{},"If you have concerns about negative comments, get more positive reviews!",[91,916,917,918,921],{},"There are several ",[106,919,920],{},"ways to show social proof"," on your product page to create trust between your website and a visitor:",[144,923,924,927,930],{},[147,925,926],{},"You can provide testimonials.",[147,928,929],{},"You may include a picture of a happy customer who tried this product.",[147,931,932],{},"Video testimonials work best and appear more trustworthy.",[91,934,935,117,939],{},[113,936],{"alt":937,"src":938,"title":937},"Customer Reviews on the product page. The Bite example","\u002Fuploads\u002FConversion_bite_reviews.jpg",[119,940],{},[119,942],{},[418,944,383],{"id":945},"detailed-product-specification",[91,947,948,949,952,953,956],{},"Some products like equipment and appliances are expected to have ",[106,950,951],{},"detailed product specifications",", and many e-commerce stores put such detailed product description in the actual product description section. However, ",[106,954,955],{},"buyers rarely read"," all the information on websites and prefer to ask for a review from their community or watch third-party product reviews when they are considering purchasing a product.",[209,958,959],{},[91,960,961,962,967],{},"The average person ",[98,963,966],{"href":964,"rel":965},"https:\u002F\u002Fwww.fastcompany.com\u002F3035856\u002Fwhy-were-more-likely-to-remember-content-with-images-and-video-infogr",[102],"reads only 20%"," of a web page.",[91,969,970],{},"Moreover, many would agree that a massive list of features can look intimidating and, to be honest, tedious and even annoying for a user to read. And since we are working towards improving the user experience, we don't want to make the majority of your store visitors feel annoyed and walk away from your products.",[91,972,973],{},"For this reason, you can consider moving the extensive product specifications to a lower point on your product page.",[91,975,976,117,980],{},[113,977],{"alt":978,"src":979,"title":978},"Detailed Product Specification on the product page. The Pandora example","\u002Fuploads\u002FConversion_pandora_delivery.jpg",[119,981],{},[119,983],{},[418,985,389],{"id":986},"returns-and-refunds",[91,988,989],{},"Many shoppers would agree that it’s great to know beforehand about return and refund policies. This is why they are essential elements which should be included on the product page.",[209,991,992],{},[91,993,994,997],{},[98,995,825],{"href":823,"rel":996},[102]," say that a difficult return process is likely to stop them from buying.",[91,999,1000,117,1004],{},[113,1001],{"alt":1002,"src":1003,"title":1002},"Returns and Refunds deatils on the product page. The Fox Maiden example","\u002Fuploads\u002FConversion_foxmaiden.jpg",[119,1005],{},[119,1007],{},[91,1009,1010],{},"To conclude, when users are making a purchasing decision, they assess your product on both an emotional and a rational basis. The product page should both excite and reassure users that they are making the right choice. Otherwise, the product page will not perform as well as it should.",[91,1012,1013],{},"It is essential to check if your current product page addresses your customers' needs and find out the elements they pay attention to, fix any flaws your current page has, and start seeing improvements in conversion rates.",[119,1015],{},[1017,1018,117],"card",{"link":128,"title":1019,"description":1020,"logo":1021,"site-name":1022,"cover-image":1023},"Want to set up a new Shopify store or optimise your existing store for conversion?","We can help you create a great online experience that your customers will love.\u003Cbr>\u003Cbr>Click to learn more.","\u002Fuploads\u002Fit-club-logo.svg","Need an e-commerce expert? Hire us.","\u002Fcovers\u002Fshopify_cover.png",[119,1025],{},[119,1027],{},[188,1029,1031],{"id":1030},"considered-vs-impulse-purchases","Considered vs Impulse Purchases",[91,1033,1034],{},"Knowing the difference between customers’ behaviour when they make considered and impulse purchases, and applying this knowledge in practice, is likely to increase conversion of your e-commerce store.",[144,1036,1037,1043],{},[147,1038,1039],{},[98,1040,1042],{"href":1041},"#how-to-increase-conversion-for-considered-purchases","How to increase conversion for considered purchases?",[147,1044,1045],{},[98,1046,1048],{"href":1047},"#how-to-increase-conversion-for-impulse-purchases","How to increase conversion for impulse purchases?",[119,1050],{},[418,1052,1054],{"id":1053},"how-to-increase-conversion-for-considered-purchases","How to increase conversion for considered purchases",[209,1056,1057],{},[91,1058,1059,1060,1065],{},"A ",[98,1061,1064],{"href":1062,"rel":1063},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FConsidered_purchase",[102],"considered purchase"," is a complex buying decision with a high degree of financial and emotional risk and reward, which typically has a long purchase cycle and significant consequences.",[91,1067,1068,1069,1072],{},"It is important to consider ",[106,1070,1071],{},"customers’ behaviours"," when they make considered purchases. Customers usually:",[144,1074,1075,1084,1087,1090,1093,1096,1102,1105],{},[147,1076,1077,1078,234,1081],{},"Shop by ",[106,1079,1080],{},"Quality",[106,1082,1083],{},"Service",[147,1085,1086],{},"Think about a product and come back later",[147,1088,1089],{},"Ask a friend",[147,1091,1092],{},"Shop and read about the product around the web",[147,1094,1095],{},"Multi-channel",[147,1097,1098,1099],{},"Read ",[106,1100,1101],{},"Product reviews",[147,1103,1104],{},"Look at images",[147,1106,1107],{},"Anticipate that the purchasing process should not be boring.",[91,1109,1110,1113],{},[106,1111,1112],{},"What should you do to increase the conversion"," of your e-commerce website for considered purchases:",[144,1115,1116,1119,1122,1125,1128,1131,1134,1137,1140],{},[147,1117,1118],{},"Make pictures bigger in size and higher in quality",[147,1120,1121],{},"Allow saving a product for revisiting later",[147,1123,1124],{},"Allow users to continue on another device by emailing their choices",[147,1126,1127],{},"If a product was 'saved for later' or is in an abandoned cart, consider sending the user a reminder via email in 4+ hours, 24+ hours and 3+ days",[147,1129,1130],{},"Having Product Reviews are essential",[147,1132,1133],{},"Third-party product reviews are also important",[147,1135,1136],{},"Show previously viewed items",[147,1138,1139],{},"The purchase is about emotions and not features",[147,1141,1142],{},"Make the purchasing process fun.",[91,1144,1145,1146],{},"![Customers' behaviour and considered purchases. The Koala example](\u002Fuploads\u002FConversion_koala_fun.jpg 'Customers' behaviour and considered purchases. The Koala example') ",[119,1147],{},[119,1149],{},[418,1151,1153],{"id":1152},"how-to-increase-conversion-for-impulse-purchases","How to increase conversion for impulse purchases",[209,1155,1156],{},[91,1157,1158,1159,1164],{},"An ",[98,1160,1163],{"href":1161,"rel":1162},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FImpulse_purchase",[102],"impulse purchase"," is a spur of the moment decision, where emotions and feelings play a decisive role in purchasing, triggered by seeing the product, or being exposed to a well-crafted promotional message.",[91,1166,1167,1168,1170],{},"It is essential to understand ",[106,1169,1071],{}," when they make impulse purchases:",[144,1172,1173,1181,1184,1187,1190,1193,1196,1201],{},[147,1174,1175,234,1177,1180],{},[106,1176,359],{},[106,1178,1179],{},"Shipping speed"," are important",[147,1182,1183],{},"Fear of missing out (FOMO) may drive their behaviour",[147,1185,1186],{},"Like doing it on their own, not necessarily seeking advice from a friend",[147,1188,1189],{},"Want to just get it over and done with",[147,1191,1192],{},"Mono-channel",[147,1194,1195],{},"Shop around",[147,1197,1198,1180],{},[106,1199,1200],{},"Vendor reviews",[147,1202,1203],{},"Impulse buyers love low-risk transactions.",[91,1205,1206,1209],{},[106,1207,1208],{},"What to do to increase the conversion"," of your e-commerce website for impulse purchases:",[144,1211,1212,1215,1218,1221,1224,1233,1236,1253],{},[147,1213,1214],{},"Make pictures bigger and high-quality",[147,1216,1217],{},"Low prices \u002F Low-price guarantees",[147,1219,1220],{},"Money-back guarantees \u002F Warranties",[147,1222,1223],{},"Reviews of the brand are important",[147,1225,1226,234,1229,1232],{},[106,1227,1228],{},"Clear shipping times",[106,1230,1231],{},"costs",". Consider conditional free shipping as it is quite powerful and can motivate visitors to buy. Add fast shipping at a premium cost.",[147,1234,1235],{},"Easy to reorder previously purchased items",[147,1237,1238,1241,1242,483,1245,1248,1249,1252],{},[106,1239,1240],{},"Avoid"," any ",[106,1243,1244],{},"pop-ups",[106,1246,1247],{},"delays",", and ",[106,1250,1251],{},"distractions",". Make the purchasing process as smooth and quick as possible.",[147,1254,1255],{},"Improved usability for mobile devices is critical.",[91,1257,1258,1259],{},"![Customers' behaviour and impulse purchases. The Pandora example](\u002Fuploads\u002FConversion_pandora_send_hint.jpg 'Customers' behaviour and impulse purchases. The Pandora example') ",[119,1260],{},[119,1262],{},[91,1264,1265],{},"In conclusion, to boost your sales, it is essential to use psychology and research to understand your customers’ behaviour and needs because by leveraging these concepts, you can enhance user experience on your site and the bottom line for your business. Your e-commerce store visitors will not notice any difference, but eventually, you will be happy you made an effort of adding these concepts to your online store to improve its success.",[1267,1268,1269,1270,1279],"div",{},"\n    ",[98,1271,1278],{"className":1272,"target":1276,"href":1277},[1273,1274,1275],"base-button","base-button--dark","base-button--outlined","_blank","\u002Fuploads\u002Fhow-to-increase-ecommerce-conversion-rates-free-download.pdf","\n    Free cheat sheet download\n    ","\n  ",[119,1281],{},[119,1283],{},[1017,1285,1290],{"link":1286,"title":1287,"description":1288,"logo":1021,"site-name":1022,"cover-image":1289},"https:\u002F\u002Fitclub.com.au\u002F","Need an exceptional user experience for your online store?","Our niche skills in e-commerce help us deliver great results that create an exceptional online shopping experience for your customers.\u003Cbr>\u003Cbr>Click here to learn more.","\u002Fcover.jpg","\n \n",[119,1292],{},[119,1294],{},[1267,1296,1300],{"dataCmsId":1297,"className":1298},"cta-button",[1299],"align-center",[1267,1301,1304],{"className":1302},[1303],"button",[98,1305,1308],{"href":52,"className":1306},[1307],"cta","Got a question? Get in touch",[119,1310],{},[119,1312],{},[188,1314,1316],{"id":1315},"resources-and-appreciations","Resources and appreciations",[1318,1319,1320,1322,1325,1328,1331,1334,1337,1340,1343,1346,1349,1352,1355,1363,1366,1369],"ol",{},[147,1321,103],{},[147,1323,1324],{},"Amar Hussain: 5 Psychological Concepts Web Designers Should Use to Maximize Conversions",[147,1326,1327],{},"Conversion Optimisation: Close the Conversion Gap. Cater to the Impulse Purchase",[147,1329,1330],{},"Danny Goodwin: Top Google Result Gets 36.4% of Clicks, Study",[147,1332,1333],{},"Dave Lloyd: SEO for Success in Video Marketing",[147,1335,1336],{},"IRP Commerce: ECommerce Benchmarks and eCommerce Market Data",[147,1338,1339],{},"FastCompany: Why We’re More Likely To Remember Content With Images And Video (Infographic)",[147,1341,1342],{},"Gabe Donnini: Google Results Position: How Much Is First Place Really Worth?",[147,1344,1345],{},"Joe Leech: How to do a UX Review: The Definitive Guide",[147,1347,1348],{},"Joe Leech: The Top UX Elements to Optimize Your Clients’ Product Page Design",[147,1350,1351],{},"Littledata: 6 essential benchmarks for Shopify stores",[147,1353,1354],{},"Sheena Sethi Iyengar, Mark Lepper: When Choice is Demotivating: Can One Desire Too Much of a Good Thing? January 2001 Journal of Personality and Social Psychology",[147,1356,1357,1358],{},"The jar icon made by Darius Dan from ",[98,1359,1362],{"href":1360,"rel":1361},"http:\u002F\u002Fwww.flaticon.com",[102],"www.flaticon.com",[147,1364,1365],{},"Think with Google: The Rise of Comparison Shopping on Mobile: Which-One's-Best Moments",[147,1367,1368],{},"Tracey Wallace: Modern Consumer Behavior in the New Omni-Channel World + 31 Expert Tips to Dominate It Now",[147,1370,1371],{},"Ultralinx: Impact of images on social media | Infographic",[119,1373],{},[119,1375],{},{"title":25,"searchDepth":1377,"depth":1377,"links":1378},2,[1379,1380,1381,1394,1398],{"id":190,"depth":1377,"text":152},{"id":218,"depth":1377,"text":158},{"id":294,"depth":1377,"text":164,"children":1382},[1383,1385,1386,1387,1388,1389,1390,1391,1392,1393],{"id":420,"depth":1384,"text":335},3,{"id":495,"depth":1384,"text":341},{"id":568,"depth":1384,"text":347},{"id":637,"depth":1384,"text":353},{"id":714,"depth":1384,"text":359},{"id":739,"depth":1384,"text":365},{"id":798,"depth":1384,"text":371},{"id":863,"depth":1384,"text":377},{"id":945,"depth":1384,"text":383},{"id":986,"depth":1384,"text":389},{"id":1030,"depth":1377,"text":1031,"children":1395},[1396,1397],{"id":1053,"depth":1384,"text":1054},{"id":1152,"depth":1384,"text":1153},{"id":1315,"depth":1377,"text":1316},"\u002Fuploads\u002Fthe-ultimate-guide-to-increase-ecommerce-conversion-rates.png","2020-06-24T08:15:54.187Z","Want to improve the conversion rate of your online store? Here's everything you need to know on how to increase your online store conversion and boost sales.","md",[1404,1407,1410,1413],{"question":1405,"answer":1406},"How is an e-commerce conversion rate calculated?","The e-commerce conversion rate formula is: E-commerce conversion rate, % = Total Number of Purchases \u002F Total number of sessions.",{"question":1408,"answer":1409},"What is the e-commerce conversion rate?","E-commerce conversion rate measures how well your website traffic converts into customers. The formula is the number of purchases divided by the total number of sessions. This is because most visitors take more than one session to make a purchasing decision.",{"question":1411,"answer":1412},"What is an average ecommerce conversion rate by industry in 2020?","According to IRP Commerce, e-commerce conversion rates by the industry as of November 2020 [27 December 2020 update] constituted: Health and Wellbeing\t3.23% Fashion Clothing & Accessories\t2.42% Food & Drink\t2.37% Cars and Motorcycling\t1.51% Electrical & Commercial Equipment\t2.26% Sports and Recreation\t1.27% Pet Care\t3.37% Baby & Child\t1.14% Arts and Crafts\t4.04% Kitchen & Home Appliances\t3.03%.",{"question":1414,"answer":1415},"How to increase an e-commerce conversion rate?","Knowing the difference between customers’ behaviour when they make considered and impulse purchases, and applying this knowledge in practice, is likely to increase conversion of your e-commerce store. Also, you might need to optimise the user experience on your product page.",{},{"description":1401,"title":85},true,"\u002Fthe-ultimate-guide-to-increase-ecommerce-conversion-rates",{"title":85,"description":1401},{"loc":1419},"web-development\u002Fecommerce-conversion-rates","Here's everything you need to know on how to increase your online store conversion and boost sales.",[1425,1426,1427],"E-commerce","Shopify","UX","srArBaoLo1XIrSTlB6RVbctnHddsfh4DkodqxgmvGIk",[1430,2047,2633,3190],{"id":1431,"title":1432,"authorBio":1433,"body":1434,"coverImage":2030,"date":2031,"description":2032,"extension":1402,"faq":2033,"heroImage":2030,"lastReviewed":86,"meta":2034,"metadata":2035,"navigation":1418,"path":2037,"readingTime":2038,"reviewedAgainst":2039,"seo":2040,"sitemap":2041,"stem":2042,"summary":2043,"tags":2044,"thumbnail":2030,"__hash__":2046},"blog\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach.md","Latitude Financial Data Breach: Lessons for Small Businesses","Written by Elena Osipova, CPA, an emerging cyber security practitioner with professional background in finance, accounting and business operations. She writes about financial data breaches, cyber security governance and practical security controls for Australian small businesses.",{"type":88,"value":1435,"toc":2014},[1436,1439,1444,1447,1467,1470,1473,1476,1480,1483,1486,1536,1539,1542,1545,1549,1653,1657,1664,1684,1687,1691,1723,1727,1762,1766,1769,1795,1799,1855,1859,1862,1866,1880,1884,1922,1926,1929,1949,1953,1956,1959,1966,1970],[91,1437,1438],{},"In March 2023, Latitude Financial suffered what remains one of the largest data breaches in Australian history.",[209,1440,1441],{},[91,1442,1443],{},"Latitude Financial is the ASX-listed lender behind Gem, GO Mastercard and 28° Global. It provides personal loans, credit cards and point-of-sale interest-free finance to around 2.8 million customer accounts across Australia and New Zealand.",[91,1445,1446],{},"An attacker who compromised one of Latitude's vendors obtained Latitude employee login credentials and used them to extract customer data from two other service providers. The stolen data included:",[144,1448,1449,1452,1455,1458,1461,1464],{},[147,1450,1451],{},"~7.9 million Australian and NZ driver licence numbers",[147,1453,1454],{},"~103,000 copies of driver licences or passports",[147,1456,1457],{},"~53,000 passport numbers",[147,1459,1460],{},"~6.1 million additional records, some dating back to at least 2005",[147,1462,1463],{},"income and expense information used in ~900,000 loan applications, including - ~308,000 bank account numbers and ~143,000 credit card or credit card account numbers;",[147,1465,1466],{},"less than 100 customers with monthly financial statements.",[91,1468,1469],{},"Many affected people were former customers and applicants, and some information dated back nearly two decades.",[91,1471,1472],{},"Due to its impact, this breach is among major Australian breaches along with Optus and Medibank, intensifying the debate about privacy reform, data retention and cyber security.",[91,1474,1475],{},"The weaknesses that contributed to the impact of this breach - third-party access, one compromised account reaching multiple sources of sensitive information, and retaining large volumes of historical data - can exist in businesses of every size. And as for small businesses, there are usually fewer designated defences available for IT and security.",[188,1477,1479],{"id":1478},"what-happened","What happened",[91,1481,1482],{},"On 16 March 2023, Latitude Financial entered a trading halt at ASX and disclosed a cyberattack, describing it as \"sophisticated and malicious\". It was initially disclosed that approximately 103,000 identification documents and 225,000 customer records were stolen.",[91,1484,1485],{},"By 27 March, Latitude confirmed the theft of records relating to approximately 14 million customer and applicant records. The stolen information included:",[144,1487,1488,1494,1500,1506,1512,1518,1524,1530],{},[147,1489,1490,1493],{},[106,1491,1492],{},"Driver licence numbers:"," ~7.9 million Australian and New Zealand",[147,1495,1496,1499],{},[106,1497,1498],{},"Passport numbers:"," ~53,000 records",[147,1501,1502,1505],{},[106,1503,1504],{},"Records containing names, addresses, dates of birth and phone numbers:"," ~6.1 million, with some dating back to at least 2005",[147,1507,1508,1511],{},[106,1509,1510],{},"Images of driver licences or passports:"," 103,000 records",[147,1513,1514,1517],{},[106,1515,1516],{},"Income and expense information:"," ~900,000 loan applications",[147,1519,1520,1523],{},[106,1521,1522],{},"Bank account numbers:"," ~308,000 records",[147,1525,1526,1529],{},[106,1527,1528],{},"Credit card or credit account numbers:","  ~143,000 records",[147,1531,1532,1535],{},[106,1533,1534],{},"Monthly financial statements:"," less than 100 customers.",[91,1537,1538],{},"Latitude said bank-account passwords, card expiry dates and three-digit security codes were not compromised.",[91,1540,1541],{},"Latitude received the ransom demand but refused to pay it, explicitly aligning with the Australian Government's position.",[91,1543,1544],{},"As of July 2026, no attacker has been publicly identified or charged in connection with this breach.",[188,1546,1548],{"id":1547},"the-timeline","The timeline",[1550,1551,1552,1569],"table",{},[1553,1554,1555],"thead",{},[1556,1557,1558,1564],"tr",{},[1559,1560,1561],"th",{},[106,1562,1563],{},"Date",[1559,1565,1566],{},[106,1567,1568],{},"Event",[1570,1571,1572,1583,1593,1603,1613,1623,1633,1643],"tbody",{},[1556,1573,1574,1580],{},[1575,1576,1577],"td",{},[106,1578,1579],{},"Prior to 16 March 2023",[1575,1581,1582],{},"An attacker obtains a compromised employee credential through one of Latitude’s vendors.  Latitude detects unusual activity and begins its response.",[1556,1584,1585,1590],{},[1575,1586,1587],{},[106,1588,1589],{},"16 March 2023",[1575,1591,1592],{},"Latitude enters an ASX trading halt and publicly discloses the breach. Early findings: ~330,000 customers and applicants affected.",[1556,1594,1595,1600],{},[1575,1596,1597],{},[106,1598,1599],{},"27 March 2023",[1575,1601,1602],{},"The full scale of the breach disclosed: ~14 million records.",[1556,1604,1605,1610],{},[1575,1606,1607],{},[106,1608,1609],{},"11 April 2023",[1575,1611,1612],{},"Latitude confirms a ransom demand and refuses to pay.",[1556,1614,1615,1620],{},[1575,1616,1617],{},[106,1618,1619],{},"April - May 2023",[1575,1621,1622],{},"~6 weeks of severe business disruption: new lending paused, collections interruptions.",[1556,1624,1625,1630],{},[1575,1626,1627],{},[106,1628,1629],{},"May 2023",[1575,1631,1632],{},"The OAIC and NZ Privacy Commissioner open a joint investigation into Latitude's information handling.",[1556,1634,1635,1640],{},[1575,1636,1637],{},[106,1638,1639],{},"Aug 2023",[1575,1641,1642],{},"Latitude reports $76M of pre-tax cyber-related costs and provisions related to the incident and $98.2M statutory loss after tax.",[1556,1644,1645,1650],{},[1575,1646,1647],{},[106,1648,1649],{},"2023 - 2024",[1575,1651,1652],{},"Gordon Legal and Hayden Stephens and Associates lodged a representative complaint with the OAIC on behalf of affected individuals.",[188,1654,1656],{"id":1655},"how-the-attacker-gained-access","How the attacker gained access",[91,1658,1659,1660,1663],{},"Based on Latitude’s public disclosures, the incident began with a ",[106,1661,1662],{},"third-party credential compromise",", rather than a technical exploit. Here’s how the cybercriminals got in:",[1318,1665,1666,1672,1678],{},[147,1667,1668,1671],{},[106,1669,1670],{},"Third-party compromise."," The attack originated from one of Latitude’s major vendors.",[147,1673,1674,1677],{},[106,1675,1676],{},"Theft of a valid login credential."," From the vendor environment, the attacker obtained active credentials belonging to a Latitude employee.",[147,1679,1680,1683],{},[106,1681,1682],{},"Large-scale data theft."," The attacker used that credential to gain unauthorised access to personal information of current and historical customers and applicants, resulting in approximately 14 million records stolen.",[91,1685,1686],{},"Public disclosures have not identified malware, a zero-day vulnerability, or phishing against Latitude employees as the initial access method. The confirmed starting point was a compromised credential obtained through a third party that unlocked almost two decades of identity data.",[188,1688,1690],{"id":1689},"_5-reasons-the-breach-had-such-a-large-impact","5 reasons the breach had such a large impact",[1318,1692,1693,1699,1705,1711,1717],{},[147,1694,1695,1698],{},[106,1696,1697],{},"A third-party compromise reached Latitude."," Based on reports, the attacker obtained a valid employee credential through a compromised third party. This shows how a supplier’s security weakness can become a customer’s security incident. Businesses should know which vendors can access their systems and data, limit that access to what is necessary and remove it when it is no longer needed.",[147,1700,1701,1704],{},[106,1702,1703],{},"Stolen credentials worked, at scale."," The compromised credential provided sufficient access for the attacker to retrieve large volumes of data. Public information does not establish whether MFA was absent, bypassed or otherwise ineffective. The suspicious activity was not detected or interrupted early enough to prevent large-scale data theft.",[147,1706,1707,1710],{},[106,1708,1709],{},"Historical data increased the consequences."," Some stolen records dated back to at least 2005 and related to former customers and unsuccessful applicants. Australian Privacy Principle 11.2 generally requires an organisation to take reasonable steps to destroy or de-identify personal information no longer needed, unless it must be retained under other legal requirements. In May 2023, the OAIC and New Zealand Privacy Commissioner started a joint investigation into whether Latitude met that obligation.",[147,1712,1713,1716],{},[106,1714,1715],{},"Valuable identity information was concentrated."," The attackers were able to reach Latitude’s customer and applicant records in the service-provider systems with one set of employee credentials. The stolen information included driver licence and passport details, document images, Medicare information and financial information provided during credit applications. Where retention is legally or operationally necessary, the information should be isolated, encrypted, tightly access-controlled and deleted when the retention requirement ends.",[147,1718,1719,1722],{},[106,1720,1721],{},"Detection did not prevent large-scale theft."," Latitude detected unusual activity and moved to contain the incident, but substantial information had already been compromised. Businesses should have alerts on unusual behaviour such as mass searches, bulk downloads, large exports, access from new locations and one account rapidly accessing several sensitive systems.",[188,1724,1726],{"id":1725},"what-it-cost","What it cost",[144,1728,1729,1739,1745,1751,1757],{},[147,1730,1731,1732,1735,1736,506],{},"In August 2023, Latitude reported ",[106,1733,1734],{},"$76 million in pre-tax March-incident-related costs and provisions",", contributing to a ",[106,1737,1738],{},"$98.2 million after tax loss from continuing operations for the half-year",[147,1740,1741,1744],{},[106,1742,1743],{},"Business operation disruption:"," For around 6 weeks, Latitude paused the new lending and loan collections were disrupted.",[147,1746,1747,1750],{},[106,1748,1749],{},"Cost for reimbursing identity document replacement"," for millions of people",[147,1752,1753,1756],{},[106,1754,1755],{},"Legal and regulatory exposure:"," Serious privacy contraventions can expose a company to substantial civil penalties, although a data breach does not automatically mean that the maximum penalty will apply.",[147,1758,1759],{},[106,1760,1761],{},"Reputational damage.",[188,1763,1765],{"id":1764},"what-latitude-did-well","What Latitude did well",[91,1767,1768],{},"Although the breach exposed serious weaknesses, several aspects of Latitude’s incident response are worth recognising:",[144,1770,1771,1777,1783,1789],{},[147,1772,1773,1776],{},[106,1774,1775],{},"Early disclosure:"," Latitude disclosed the cyberattack and entered a trading halt on 16 March 2023 while the investigation was still underway.",[147,1778,1779,1782],{},[106,1780,1781],{},"Containment and operational action:"," Latitude isolated affected systems, paused parts of its onboarding new customers and worked with cyber security specialists, the ACSC, AFP and other government agencies.",[147,1784,1785,1788],{},[106,1786,1787],{},"Refusal to pay the ransom:"," Latitude publicly stated that it would not pay the attacker, aligning its position with Australian Government advice.",[147,1790,1791,1794],{},[106,1792,1793],{},"Support for affected people:"," Latitude offered to reimburse reasonable costs for replacing compromised identity documents and provided information about protective steps customers could take.",[188,1796,1798],{"id":1797},"_9-lessons-for-your-business","9 lessons for your business",[1318,1800,1801,1807,1813,1819,1825,1831,1837,1843,1849],{},[147,1802,1803,1806],{},[106,1804,1805],{},"Do not keep data longer than necessary."," Review what personal information your business holds, why it’s needed, and how long it must be retained? Australian Privacy Principle 11.2 generally requires an organisation to take reasonable steps to destroy or de-identify personal information it no longer needs, unless it must retain the information under another legal obligation. Historical information increased the scale of the Latitude breach. Cybercriminals cannot steal data your business no longer holds.",[147,1808,1809,1812],{},[106,1810,1811],{},"Minimise stored identity documents."," Verify identity without retaining a full document image where the law and business process allow. If retention is required, store only the minimum information, encrypt it, isolate it, restrict access and delete it as soon as the applicable retention period ends.",[147,1814,1815,1818],{},[106,1816,1817],{},"Your vendors' security affects your business."," Know which third parties hold your data or can access your systems. This may include IT providers, bookkeepers and software platforms. Require MFA, prompt breach notification and clear security obligations.",[147,1820,1821,1824],{},[106,1822,1823],{},"Review third-party access regularly."," Keep a record of every vendor account, what it can access and who approved it. Remove access immediately when it is no longer required.",[147,1826,1827,1830],{},[106,1828,1829],{},"Make stolen credentials insufficient."," Require MFA for remote, administrator and third-party access. Give every account only Limit each account only the access it needs. Set alerts on unusual behaviour, such as new login locations, bulk downloads or access outside expected hours.",[147,1832,1833,1836],{},[106,1834,1835],{},"Control large data exports."," Restrict who can download or export sensitive information. Set alerts on unusually large downloads, repeated searches or one account accessing several sensitive systems in a short period.",[147,1838,1839,1842],{},[106,1840,1841],{},"Test your incident response plan."," A written plan is useful only if people know how to use it. Run a simple exercise covering containment, notifications, customer communication and contact with your IT provider.",[147,1844,1845,1848],{},[106,1846,1847],{},"Decide your ransom position before an incident."," Document who has authority to make the decision and obtain legal, law-enforcement, insurance and incident-response advice. Paying a ransom does not guarantee that stolen data will be deleted, returned or kept private.",[147,1850,1851,1854],{},[106,1852,1853],{},"Explain that early breach figures may change."," Clearly label early figures as preliminary. Then may change as the forensic investigation progresses.",[188,1856,1858],{"id":1857},"how-cyber-security-frameworks-apply","How cyber security frameworks apply",[91,1860,1861],{},"While the publicly available information is limited and does not provide enough technical detail to map every stage of the Latitude attack, the incident can still be examined using established cyber security frameworks.",[418,1863,1865],{"id":1864},"mitre-attck-helps-understand-the-attackers-behaviour","MITRE ATT&CK helps understand the attacker’s behaviour",[144,1867,1868,1874],{},[147,1869,1870,1873],{},[106,1871,1872],{},"Valid Accounts (T1078):"," This technique is consistent with the publicly known facts because the attacker obtained a valid employee credential to gain unauthorised access to sensitive information.",[147,1875,1876,1879],{},[106,1877,1878],{},"Data from Information Repositories (T1213):"," The data theft from customer and applicant systems may be consistent with this technique.",[418,1881,1883],{"id":1882},"nist-cybersecurity-framework-20-helps-organise-the-lessons","NIST Cybersecurity Framework 2.0 helps organise the lessons",[144,1885,1886,1892,1898,1904,1910,1916],{},[147,1887,1888,1891],{},[106,1889,1890],{},"Govern:"," Assign responsibility for cyber security, privacy, data retention and third-party risk. Set security requirements for vendors and check that they are followed.",[147,1893,1894,1897],{},[106,1895,1896],{},"Identify:"," Know what personal information the business holds, where it is stored, why it is needed, who can access it and when it should be deleted.",[147,1899,1900,1903],{},[106,1901,1902],{},"Protect:"," Use least privilege, strong MFA, encryption, access segmentation and controls that limit large downloads or exports.",[147,1905,1906,1909],{},[106,1907,1908],{},"Detect:"," Monitor successful and failed logins. Alert on unusual locations, new devices, mass downloads and access across sensitive systems.",[147,1911,1912,1915],{},[106,1913,1914],{},"Respond:"," Maintain and test an incident-response plan covering containment, legal and privacy assessment, communication and customer support.",[147,1917,1918,1921],{},[106,1919,1920],{},"Recover:"," Restore services safely, support affected people and update systems, contracts and retention practices after the incident.",[418,1923,1925],{"id":1924},"acscs-essential-eight","ACSC’s Essential Eight",[91,1927,1928],{},"Although the Essential Eight does not cover every issue raised by this data breach, it is a useful Australian technical baseline. The most relevant strategies include:",[144,1930,1931,1937,1943],{},[147,1932,1933,1936],{},[106,1934,1935],{},"Multi-factor authentication:"," Require MFA for employees, administrators, vendors and access to sensitive systems.",[147,1938,1939,1942],{},[106,1940,1941],{},"Restrict administrative privileges:"," Give your employees and service providers only the access required for their work. Review privileged access regularly and remove it when it is no longer needed.",[147,1944,1945,1948],{},[106,1946,1947],{},"Regular backups:"," Maintain protected and tested backups to support operational recovery.",[188,1950,1952],{"id":1951},"final-takeaway","Final takeaway",[91,1954,1955],{},"The Latitude breach was not only a story about a compromised credential. It also showed how much sensitive information one account could reach, how third-party access can connect multiple systems, and how historical data can increase the harm caused by an incident.",[91,1957,1958],{},"Small businesses may hold fewer records, but the same risks apply. Know what personal information you hold, remove information you no longer need, limit each account to the minimum access required and monitor unusual activity after login.",[91,1960,1961,1962,1965],{},"Use our ",[98,1963,1964],{"href":37},"DIY cyber security health check"," to review your current controls and identify practical steps for improvement.",[188,1967,1969],{"id":1968},"sources-used","Sources used",[144,1971,1972,1975,1978,1981,1984,1987,1990,1993,1996,1999,2002,2005,2008,2011],{},[147,1973,1974],{},"Latitude Financial, Cybercrime Update, 20 March 2023",[147,1976,1977],{},"Latitude Financial, Cybercrime Update, 27 March 2023",[147,1979,1980],{},"Latitude Financial, Cybercrime Update 11 April 2023",[147,1982,1983],{},"Latitude Financial, Latitude Cyber Response",[147,1985,1986],{},"OAIC, Joint Australia-New Zealand investigation into Latitude group",[147,1988,1989],{},"OAIC, Statement on Latitude Financial data breach",[147,1991,1992],{},"New Zealand Office of the Privacy Commissioner, New Zealand - Australia investigation into Latitude breach begins",[147,1994,1995],{},"Latitude Group Holdings, 1H23 Results",[147,1997,1998],{},"MITRE ATT&CK, Valid Accounts - T1078",[147,2000,2001],{},"MITRE ATT&CK, Data from Information Repositories - T1213",[147,2003,2004],{},"NIST, Cybersecurity Framework 2.0",[147,2006,2007],{},"ASD, ACSC’s Essential Eight Maturity Model",[147,2009,2010],{},"Australian Government, Australian Privacy Principles Guidelines, Chapter 11",[147,2012,2013],{},"Gordon Legal, Latitude Financial privacy breach representative complaint",{"title":25,"searchDepth":1377,"depth":1377,"links":2015},[2016,2017,2018,2019,2020,2021,2022,2023,2028,2029],{"id":1478,"depth":1377,"text":1479},{"id":1547,"depth":1377,"text":1548},{"id":1655,"depth":1377,"text":1656},{"id":1689,"depth":1377,"text":1690},{"id":1725,"depth":1377,"text":1726},{"id":1764,"depth":1377,"text":1765},{"id":1797,"depth":1377,"text":1798},{"id":1857,"depth":1377,"text":1858,"children":2024},[2025,2026,2027],{"id":1864,"depth":1384,"text":1865},{"id":1882,"depth":1384,"text":1883},{"id":1924,"depth":1384,"text":1925},{"id":1951,"depth":1377,"text":1952},{"id":1968,"depth":1377,"text":1969},"\u002Fcovers\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial.jpg","2026-07-27T00:00:00.000Z","The 2023 Latitude Financial breach exposed millions of customer and applicant records. Learn how third-party access, stolen credentials and excessive data retention increased the impact - and what small businesses should do differently.",[],{},{"description":2036,"title":1432},"How the 2023 Latitude Financial incident happened. What Australian small businesses can learn about data retention, vendor access, MFA and breach response.","\u002Fcyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach",10,"Reviewed against current guidance from ASD Australian Cyber Security Centre, the OAIC, NIST CSF 2.0 and MITRE ATT&CK",{"title":1432,"description":2032},{"loc":2037},"cyber-security\u002Fbreach-lessons\u002Flatitude-financial-breach","The 2023 Latitude Financial breach exposed approximately 14 million records, including information dating back to 2005. Here is what Australian businesses can learn about data retention, third-party access, stolen credentials and breach response.",[48,2045],"Breach Lessons","TA8niaCikqD3pvid8DbV6jcw4Bh_aFDwyyEIa8P8djs",{"id":2048,"title":2049,"authorBio":2050,"body":2051,"coverImage":2618,"date":2031,"description":2619,"extension":1402,"faq":2620,"heroImage":2618,"lastReviewed":86,"meta":2621,"metadata":2622,"navigation":1418,"path":2624,"readingTime":2625,"reviewedAgainst":2626,"seo":2627,"sitemap":2628,"stem":2629,"summary":2630,"tags":2631,"thumbnail":2618,"__hash__":2632},"blog\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank-breach.md","What The Medibank Breach Teaches Small Businesses","Written by Elena Osipova, CPA, an emerging Cyber Security Practitioner. Elena writes about enterprise breaches, cyber security governance and practical security controls to help Australian small businesses improve their own defences.",{"type":88,"value":2052,"toc":2602},[2053,2056,2061,2064,2067,2070,2072,2075,2078,2081,2084,2086,2252,2254,2257,2277,2284,2286,2318,2320,2364,2368,2371,2391,2395,2457,2459,2462,2466,2490,2494,2526,2528,2531,2543,2545,2548,2551,2556,2558],[91,2054,2055],{},"In October 2022, Medibank, one of Australia's largest private health insurers, disclosed that a cybercriminal had stolen about 520GB of data. The breach affected around 9.7 million current and former Medibank, ahm and international customers and representatives, including people whose sensitive health claims information was exposed.",[209,2057,2058],{},[91,2059,2060],{},"Through its Medibank and ahm brands, the group insures millions of people across Australia.",[91,2062,2063],{},"The weaknesses that contributed to this breach were not unusual. According to allegations filed by the Australian Information Commissioner, an employee of a Medibank IT contractor saved Medibank credentials in his browser profile on a work computer. When he signed into the same browser profile on a personal computer, the credentials synchronised to that device and were later stolen by malware.",[91,2065,2066],{},"A cybercriminal then used the compromised credentials to access Medibank’s remote-access VPN, which did not require MFA for that login method. Medibank’s security software raised alerts about suspicious activity, but they were delayed to triage for weeks.",[91,2068,2069],{},"Three basic controls failed in a large organisation. Every one of them could be missing in small businesses too.",[188,2071,1479],{"id":1478},[91,2073,2074],{},"On 13 October 2022, Medibank disclosed unusual activity on its network and initially said there was no evidence that customer data had been removed. On 19 and 22 October, an attacker contacted Medibank and supplied sample files. Medibank later confirmed that information connected to around 9.7 million people had been stolen. The OAIC alleges that about 520GB of data was exfiltrated between late August and 13 October 2022.",[91,2076,2077],{},"The attacker demanded US$10 million. Medibank refused to pay, explaining that payment could not guarantee the return or deletion of the data and might encourage further extortion.",[91,2079,2080],{},"From 9 November to 1 December 2022, stolen information was published on a dark-web leak site in stages, fully releasing the dataset. Published files included highly sensitive health claims information, including records about HIV, drug and alcohol treatment, mental health, and abortions. Australian authorities later attributed the attack to Russian national Aleksandr Ermakov, who was associated with the REvil cybercrime group.",[91,2082,2083],{},"In January 2024, Australia used its cyber sanctions framework for the first time and designated Aleksandr Ermakov for his role in the Medibank breach, imposing targeted financial sanctions and a travel ban. Dealing with a designated person or their assets can be a criminal offence carrying severe penalties, including up to 10 years’ imprisonment for an individual.",[188,2085,1548],{"id":1547},[1550,2087,2088,2100],{},[1553,2089,2090],{},[1556,2091,2092,2096],{},[1559,2093,2094],{},[106,2095,1563],{},[1559,2097,2098],{},[106,2099,1568],{},[1570,2101,2102,2112,2122,2132,2142,2152,2162,2172,2182,2192,2202,2212,2222,2232,2242],{},[1556,2103,2104,2109],{},[1575,2105,2106],{},[106,2107,2108],{},"Prior to 7 August 2022",[1575,2110,2111],{},"A contractor employee saved Medibank credentials in a browser profile on a work computer. The credentials were later synchronised to his personal computer.",[1556,2113,2114,2119],{},[1575,2115,2116],{},[106,2117,2118],{},"Around 7 August 2022",[1575,2120,2121],{},"Malware on the personal computer stole the Medibank credentials.",[1556,2123,2124,2129],{},[1575,2125,2126],{},[106,2127,2128],{},"12 August 2022",[1575,2130,2131],{},"The attacker tested the stolen admin credentials against Medibank’s Microsoft Exchange server.",[1556,2133,2134,2139],{},[1575,2135,2136],{},[106,2137,2138],{},"Around 23 August 2022",[1575,2140,2141],{},"The attacker first logged in to Medibank’s GlobalProtect VPN, with no MFA required.",[1556,2143,2144,2149],{},[1575,2145,2146],{},[106,2147,2148],{},"24 - 25 August 2022",[1575,2150,2151],{},"Medibank’s security software generated alerts, sending them to an IT operations mailbox. The OAIC alleges they were not appropriately triaged or escalated.",[1556,2153,2154,2159],{},[1575,2155,2156],{},[106,2157,2158],{},"25 August - 13 October 2022",[1575,2160,2161],{},"The attacker accessed Medibank's internal systems and exfiltrated about 520GB of data.",[1556,2163,2164,2169],{},[1575,2165,2166],{},[106,2167,2168],{},"11 October 2022",[1575,2170,2171],{},"Medibank triaged a high-severity alert and engaged its incident-response partner.",[1556,2173,2174,2179],{},[1575,2175,2176],{},[106,2177,2178],{},"13 October 2022",[1575,2180,2181],{},"Medibank publicly discloses the incident, initially stating that there was no evidence that customer data had been removed.",[1556,2183,2184,2189],{},[1575,2185,2186],{},[106,2187,2188],{},"19 and 22 October 2022",[1575,2190,2191],{},"The attacker contacted Medibank and supplied sample files with stolen data.",[1556,2193,2194,2199],{},[1575,2195,2196],{},[106,2197,2198],{},"7 November 2022",[1575,2200,2201],{},"Medibank confirmed the scale of the breach: 9.7 million people and publicly refused to pay the ransom.",[1556,2203,2204,2209],{},[1575,2205,2206],{},[106,2207,2208],{},"9 November - 1 December 2022",[1575,2210,2211],{},"Stolen information was published on the dark web in stages, ending with the full 520GB released.",[1556,2213,2214,2219],{},[1575,2215,2216],{},[106,2217,2218],{},"27 June 2023",[1575,2220,2221],{},"APRA announced a $250M increase in Medibank’s capital adequacy requirement until remediation was completed to APRA’s satisfaction.",[1556,2223,2224,2229],{},[1575,2225,2226],{},[106,2227,2228],{},"23 January 2024",[1575,2230,2231],{},"Australia imposed its first cyber sanction, designating Aleksandr Ermakov for his role in the breach.",[1556,2233,2234,2239],{},[1575,2235,2236],{},[106,2237,2238],{},"5 June 2024",[1575,2240,2241],{},"The OAIC files civil penalty proceedings in the Federal Court over alleged failure to take reasonable steps to protect personal information.",[1556,2243,2244,2249],{},[1575,2245,2246],{},[106,2247,2248],{},"As of July 2026",[1575,2250,2251],{},"The OAIC proceedings continued, and the Medibank class action remained listed as open in the Federal Court.",[188,2253,1656],{"id":1655},[91,2255,2256],{},"Based on the OAIC’s allegations and Medibank’s public updates, the incident began with stolen credentials, remote access without MFA and an account with extensive privileges. Here’s how the hacker gained access:",[1318,2258,2259,2265,2271],{},[147,2260,2261,2264],{},[106,2262,2263],{},"Credential theft through infostealer malware."," TMedibank credentials saved in a contractor employee’s browser profile were synchronised to his personal computer and were stolen by malware.",[147,2266,2267,2270],{},[106,2268,2269],{},"Remote access without MFA."," The VPN was configured to accept a username and password and did not require MFA.",[147,2272,2273,2276],{},[106,2274,2275],{},"Broad access and delayed escalation."," The compromised admin account could access most Medibank systems. The OAIC alleges that security alerts were generated from 24 August onwards but were not appropriately triaged or escalated, allowing the hacker to locate and exfiltrate about 520GB of data over seven weeks.",[91,2278,2279,2280,2283],{},"The publicly available evidence describes a ",[106,2281,2282],{},"data-theft and extortion"," incident rather than ransomware with encrypted systems. The attacker simply used valid credentials to access systems and steal data, then demanded payment to prevent publication.",[188,2285,1690],{"id":1689},[1318,2287,2288,2294,2300,2306,2312],{},[147,2289,2290,2293],{},[106,2291,2292],{},"No MFA on remote access."," A username and password were enough for the hacker to access Medibank’s systems. MFA would have added an important barrier and may have prevented or limited the initial access.",[147,2295,2296,2299],{},[106,2297,2298],{},"An unmanaged personal device."," Corporate credentials were synchronised to a personal computer outside Medibank’s managed environment, where malware stole them.",[147,2301,2302,2305],{},[106,2303,2304],{},"Poor alert response."," Detection software generated alerts, but the process for reviewing, triaging and escalating them did not work as intended.",[147,2307,2308,2311],{},[106,2309,2310],{},"One account had very broad access."," The service-desk account had access to \"most, if not all, systems\", so one stolen credential became keys to the whole building.",[147,2313,2314,2317],{},[106,2315,2316],{},"Known weaknesses were not fixed in time."," The OAIC alleges Medibank knew about the security gaps, including the MFA gap, through its cyber security audits, and failed to fix them in time.",[188,2319,1726],{"id":1725},[144,2321,2322,2328,2334,2340,2346,2352,2358],{},[147,2323,2324,2327],{},[106,2325,2326],{},"Direct response and remediation costs reached tens of millions of dollars"," across several financial years, before any final litigation outcomes.",[147,2329,2330,2333],{},[106,2331,2332],{},"Blackmail and ransom demands:"," Medibank refused the US$10M ransom,  and the stolen data was later published.",[147,2335,2336,2339],{},[106,2337,2338],{},"APRA's $250 million capital adequacy adjustment:"," This was not a fine, it required Medibank to hold additional capital until APRA was satisfied with the remediation program.",[147,2341,2342,2345],{},[106,2343,2344],{},"Regulatory and legal scrutiny:"," The ongoing OAIC civil penalty proceedings and a Federal Court class action, still listed as open.",[147,2347,2348,2351],{},[106,2349,2350],{},"Harm to affected people:",": Published information included identity details and sensitive health claims data, creating risks of fraud, scams, blackmail, identity theft and emotional distress for the affected individuals.",[147,2353,2354,2357],{},[106,2355,2356],{},"Wider impact:",": The breach contributed to national debate about privacy, cyber security and ransomware. In 2024, Australia imposed its first cyber sanction in response to the incident.",[147,2359,2360,2363],{},[106,2361,2362],{},"Reputational damage:"," The incident affected customer trust and kept Medibank under public, regulatory and legal scrutiny for years.",[188,2365,2367],{"id":2366},"what-medibank-did-well","What Medibank did well",[91,2369,2370],{},"Although the breach exposed serious weaknesses and early breach figures changed as the incident investigation progressed, several aspects of Medibank’s incident response are worth recognising:",[144,2372,2373,2376,2379,2382,2385,2388],{},[147,2374,2375],{},"Medibank provided frequent public updates as the breach scope became clearer.",[147,2377,2378],{},"It also notified regulators and law-enforcement agencies.",[147,2380,2381],{},"Medibank engaged external cyber incident-response specialists.",[147,2383,2384],{},"It refused to pay ransom, aligning with the Australian Government view.",[147,2386,2387],{},"Medibank also offered support measures, including identity monitoring and hardship support for affected customers",[147,2389,2390],{},"It also committed to remediation and security investment.",[188,2392,2394],{"id":2393},"_10-lessons-for-your-business","10 lessons for your business",[1318,2396,2397,2403,2409,2415,2421,2427,2433,2439,2445,2451],{},[147,2398,2399,2402],{},[106,2400,2401],{},"Mandatory MFA."," If one control defines this breach, it's this. Enforce mandatory MFA for VPNs, emails, cloud systems, admin accounts, contractor accounts and third-party support access.",[147,2404,2405,2408],{},[106,2406,2407],{},"Properly manage contractor access."," Administrator access should be role-based rather than universal across internal systems. Privileged access should only be granted when required, time-limited, approved, monitored and reviewed regularly. Contractors should not have privileged access to all systems and databases.",[147,2410,2411,2414],{},[106,2412,2413],{},"Require managed devices for corporate access."," Personal or unmanaged devices should not access sensitive systems unless strong technical controls are in place. Access should be limited to devices that are managed, compliant, patched and monitored.",[147,2416,2417,2420],{},[106,2418,2419],{},"Apply least privilege."," Give each user only the access needed for their role. Review privileged access regularly and remove it when it is no longer required.",[147,2422,2423,2426],{},[106,2424,2425],{},"Strengthen browser and credential security."," Do not allow corporate credentials to be stored in browsers. Use an approved password manager and configure managed browsers to control password saving and profile synchronisation.",[147,2428,2429,2432],{},[106,2430,2431],{},"Every alert needs an owner."," Decide who acts on warnings from your antivirus, bank and software - and how they should respond to them.",[147,2434,2435,2438],{},[106,2436,2437],{},"Reduce sensitive data exposure."," Keep only the information you need, restrict access, separate high-risk data, encrypt it where appropriate and monitor unusual access or large data transfers.",[147,2440,2441,2444],{},[106,2442,2443],{},"Network segmentation."," Consider separating your network into secure zones to reduce access to sensitive data.",[147,2446,2447,2450],{},[106,2448,2449],{},"Act on cyber security findings."," The OAIC alleges that Medibank's cyber security audits flagged the MFA gap. Treat audit findings, penetration-test results and insurer questionnaires as actions with owners, deadlines and management oversight.",[147,2452,2453,2456],{},[106,2454,2455],{},"Train employees and contractors."," Cover secure credential storage, approved password managers, MFA methods, risk of browser synchronisation, phishing methods, incident reporting and how to correctly respond to credential theft attempts.",[188,2458,1858],{"id":1857},[91,2460,2461],{},"While the publicly available information does not provide every technical detail of the Medibank attack, the incident can still be examined using established cyber security frameworks. This can help turn the incident into a structured set of lessons.",[418,2463,2465],{"id":2464},"mitre-attck-helps-understand-the-attackers-behaviours","MITRE ATT&CK helps understand the attacker's behaviours",[144,2467,2468,2474,2480,2485],{},[147,2469,2470,2473],{},[106,2471,2472],{},"Credentials from Web Browsers (T1555.003):"," The OAIC alleges that Medibank credentials saved in a contractor’s work browser profile were synchronised to a personal computer and later stolen by information-stealing malware.",[147,2475,2476,2479],{},[106,2477,2478],{},"External Remote Services (T1133):"," The attacker allegedly used the stolen credentials to connect to Medibank systems through its GlobalProtect VPN.",[147,2481,2482,2484],{},[106,2483,1872],{}," The attacker used an active Medibank administrator account that allowed the login to appear similar to authorised activity.",[147,2486,2487,2489],{},[106,2488,1878],{}," After entering the environment, the attacker allegedly accessed internal systems and databases containing customer identity and health claims information.",[418,2491,2493],{"id":2492},"nist-cybersecurity-framework-20-helps-organise-management-responsibilities","NIST Cybersecurity Framework 2.0 helps organise management responsibilities",[144,2495,2496,2501,2506,2511,2516,2521],{},[147,2497,2498,2500],{},[106,2499,1890],{}," Assign responsibility for cyber security, privacy and third-party access. Set clear security requirements for contractors and ensure that known audit findings are recorded, prioritised and fixed.",[147,2502,2503,2505],{},[106,2504,1896],{}," Know which accounts have broad access, which devices can connect remotely, where sensitive customer information is stored and which systems would create the greatest harm if compromised.",[147,2507,2508,2510],{},[106,2509,1902],{}," Require strong MFA for remote and privileged access. Use managed devices, approved password manager software, least privilege, network segmentation and controls that limit access to sensitive databases.",[147,2512,2513,2515],{},[106,2514,1908],{}," Monitor VPN access, privileged-account activity, unusual devices, large searches or exports and suspicious connections between internal systems. Ensure every important alert has an owner and a defined escalation process.",[147,2517,2518,2520],{},[106,2519,1914],{}," Maintain and test an incident-response plan. It should cover disabling compromised accounts, revoking active sessions, isolating affected systems, investigating alerts, notifying regulators and communicating with affected customers.",[147,2522,2523,2525],{},[106,2524,1920],{}," Restore affected services safely, support affected people, review what went wrong and improve access controls, monitoring, contractor arrangements and incident-response procedures.",[418,2527,1925],{"id":1924},[91,2529,2530],{},"Although the Essential Eight does not cover every issue seen in this breach, it provides a useful Australian technical baseline. The most relevant to Medibank’s breach strategy include:",[144,2532,2533,2538],{},[147,2534,2535,2537],{},[106,2536,1935],{}," Require MFA for VPN access, privileged accounts, contractors and systems holding sensitive information.",[147,2539,2540,2542],{},[106,2541,1941],{}," Give employees and contractors only the access needed for their work. Use separate privileged accounts, review access regularly and remove it when it is no longer required.",[188,2544,1952],{"id":1951},[91,2546,2547],{},"The Medibank breach is sometimes framed as the work of a sophisticated Russian hacker. The practical lesson is simpler: browser-synchronised credentials were stolen from a personal device, remote access did not require MFA for the login method used, an admin account had extensive access, and security alerts were not promptly handled.",[91,2549,2550],{},"Small businesses may have fewer IT and security resources, but the same risks still matter. Know who can access your systems, require MFA, use managed devices, limit each account to the minimum access required, control browser synchronisation and make sure every important security alert has an owner.",[91,2552,1961,2553,2555],{},[98,2554,1964],{"href":37}," to review your current controls and identify practical steps to protect your business.",[188,2557,1969],{"id":1968},[144,2559,2560,2563,2566,2569,2572,2575,2578,2581,2584,2587,2590,2593,2596,2599],{},[147,2561,2562],{},"Office of the Australian Information Commissioner, Civil penalty action against Medibank and the filed concise statement (June 2024).",[147,2564,2565],{},"Australian Prudential Regulation Authority, APRA takes action against Medibank Private in relation to cyber incident” (27 June 2023).",[147,2567,2568],{},"Australian Government - Department of Foreign Affairs and Trade, Cyber sanctions in response to Medibank Private cyber attack (23 January 2024).",[147,2570,2571],{},"Australian Government - Department of Foreign Affairs and Trade, Significant cyber incidents sanctions framework.",[147,2573,2574],{},"Australian Government - Department of Foreign Affairs and Trade — Guidance Note: Cyber sanctions.",[147,2576,2577],{},"Federal Court of Australia, Current class actions - McClure v Medibank Private Limited, VID64\u002F2023.",[147,2579,2580],{},"Medibank, Cybercrime updates published from 13 October to 1 December 2022.",[147,2582,2583],{},"MITRE ATT&CK Enterprise framework, Credentials from Web Browsers, T1555.003.",[147,2585,2586],{},"MITRE ATT&CK Enterprise framework, External Remote Services, T1133.",[147,2588,2589],{},"MITRE ATT&CK Enterprise framework, Valid Accounts, T1078.",[147,2591,2592],{},"MITRE ATT&CK Enterprise framework, Data from Information Repositories, T1213.",[147,2594,2595],{},"National Institute of Standards and Technology, NIST Cybersecurity Framework 2.0.",[147,2597,2598],{},"ASD’s Australian Cyber Security Centre, Essential Eight explained.",[147,2600,2601],{},"ASD’s Australian Cyber Security Centre, Essential Eight maturity model.",{"title":25,"searchDepth":1377,"depth":1377,"links":2603},[2604,2605,2606,2607,2608,2609,2610,2611,2616,2617],{"id":1478,"depth":1377,"text":1479},{"id":1547,"depth":1377,"text":1548},{"id":1655,"depth":1377,"text":1656},{"id":1689,"depth":1377,"text":1690},{"id":1725,"depth":1377,"text":1726},{"id":2366,"depth":1377,"text":2367},{"id":2393,"depth":1377,"text":2394},{"id":1857,"depth":1377,"text":1858,"children":2612},[2613,2614,2615],{"id":2464,"depth":1384,"text":2465},{"id":2492,"depth":1384,"text":2493},{"id":1924,"depth":1384,"text":1925},{"id":1951,"depth":1377,"text":1952},{"id":1968,"depth":1377,"text":1969},"\u002Fcovers\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank.jpg","How stolen browser-saved credentials, remote access without MFA and missed security alerts contributed to the 2022 Medibank data breach - and what Australian small businesses can learn from it.",[],{},{"description":2623,"title":2049},"How the 2022 Medibank data breach happened & what Australian small businesses can learn about contractor access, browser-saved credentials, MFA and security alerts.","\u002Fcyber-security\u002Fbreach-lessons\u002Fmedibank-breach",11,"Reviewed against public information from the OAIC, APRA, ASD’s Australian Cyber Security Centre, DFAT, Medibank, MITRE ATT&CK and NIST SCF 2.0",{"title":2049,"description":2619},{"loc":2624},"cyber-security\u002Fbreach-lessons\u002Fmedibank-breach","The 2022 Medibank data breach made headlines, but the weaknesses that contributed to it are not unique to large companies. Here are the practical lessons small businesses can take from the incident.",[48,2045],"DrwgvJLPjR03gDBSyfBEqBqmq6B3GAzL3RFiqFrTSww",{"id":2634,"title":2635,"authorBio":2636,"body":2637,"coverImage":3158,"date":2031,"description":3159,"extension":1402,"faq":3160,"heroImage":3158,"lastReviewed":86,"meta":3179,"metadata":3180,"navigation":1418,"path":37,"readingTime":2038,"reviewedAgainst":3183,"seo":3184,"sitemap":3185,"stem":3186,"summary":3159,"tags":3187,"thumbnail":3158,"__hash__":3189},"blog\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check.md","The DIY Cyber Security Health Check for Small Business","Written by Elena Osipova, CPA, an emerging Cyber Security Practitioner. Elena writes about cyber security governance and practical security controls for Australian small businesses.",{"type":88,"value":2638,"toc":3142},[2639,2642,2648,2654,2660,2663,2667,2678,2724,2727,2747,2751,2758,2762,2765,2804,2808,2838,2842,2880,2884,2916,2921,2925,2934,2945,2948,2990,2997,3004,3008,3011,3014,3037,3041,3044,3047,3056,3065,3069,3072,3083,3086,3100,3102,3104],[91,2640,2641],{},"You don't need a consultant to find many of your most common cyber risks. One structured afternoon can uncover preventable gaps, such as a former employee's active login, a backup that doesn't restore files, or a payment process that trusts email alone.",[91,2643,2644,2647],{},[106,2645,2646],{},"To complete this checklist, allow around three to four hours",". A very small business may finish much sooner, while a business with more users, devices and cloud services may need additional time. You'll need administrator access to Microsoft 365 or Google Workspace, access to your backup system, and a notepad or spreadsheet for recording your findings.",[91,2649,2650,2653],{},[106,2651,2652],{},"The method matters more than the tools: look at evidence, not memory",". “I think only two people have admin access” is an assumption. Opening the admin panel and counting them gives you a fact. Each step below asks you to check an actual setting, process or record.",[91,2655,2656,2659],{},[106,2657,2658],{},"Write down every issue you find",". Unless some findings appear urgent, don’t stop to fix each issue as you go, or you may burn the whole afternoon on the first item. Fixing them comes later, in priority order shown below.",[91,2661,2662],{},"However, act immediately if you find a clear sign of active compromise. Tis includes an unknown account administrator, an unauthorised payment or an email forwarding rule you did not create.",[188,2664,2666],{"id":2665},"step-1-accounts-and-access-60-minutes","Step 1: Accounts and access - 60 minutes",[91,2668,2669,2670,2673,2674,2677],{},"Open the ",[106,2671,2672],{},"Microsoft 365 Admin Centre"," or ",[106,2675,2676],{},"Google Workspace Admin Console"," and check six things:",[144,2679,2680,2686,2700,2706,2712,2718],{},[147,2681,2682,2685],{},[106,2683,2684],{},"The user list."," Read every name. Is anyone no longer with the business but still active? Is there an account you cannot explain? Record former users for removal. Remove unknown users urgently.",[147,2687,2688,2691,2692,2695,2696,2699],{},[106,2689,2690],{},"MFA coverage."," Confirm that every user is required to use MFA and has completed registration. ",[106,2693,2694],{},"In Microsoft 365",", don’t rely only on the legacy per-user MFA status: MFA may instead be enforced through Security Defaults or Conditional Access. Check both - the organisation-wide policy and the users who have registered. ",[106,2697,2698],{},"In Google Workspace",", check 2-Step Verification enrolment and enforcement.",[147,2701,2702,2705],{},[106,2703,2704],{},"Who's an administrator?"," Count the accounts with administrator roles. There should be very few, and you should be able to explain why each person needs that level of access.",[147,2707,2708,2711],{},[106,2709,2710],{},"Guest and external access."," Review guest users, contractors, delegated mailbox access and connected third-party applications. Remove access that is no longer required.",[147,2713,2714,2717],{},[106,2715,2716],{},"Email forwarding rules."," Check the business owner's and finance mailboxes for rules that forward messages outside the business. Cyber criminals who compromise email accounts may create a hidden forwarding rule. It may remain active after the password is changed. Treat anything you do not recognise as urgent.",[147,2719,2720,2723],{},[106,2721,2722],{},"Account recovery."," For owner and administrator accounts, check the recovery email addresses, phone numbers and backup methods. Remove outdated details. Store emergency recovery codes securely and make sure the business - not one employee personally - controls the recovery process.",[91,2725,2726],{},"Other important account checks:",[144,2728,2729,2735,2741],{},[147,2730,2731,2734],{},[106,2732,2733],{},"Email domain protection."," If your business uses its own email domain, ask your email provider or IT administrator to confirm that SPF, DKIM and DMARC are configured correctly. These help other email systems recognise messages that falsely claim to come from your domain.",[147,2736,2737,2740],{},[106,2738,2739],{},"Domain-name protection."," Sign in to your domain registrar and confirm that your business controls the account, MFA is turned on, the recovery details are current and automatic renewal is enabled. Losing control of your domain can affect your website, email and password resets.",[147,2742,2743,2746],{},[106,2744,2745],{},"Passwords and shared accounts."," Check whether staff reuse passwords or share one login. Each person should have their own account. All important accounts should use unique passwords stored in a reputable password manager.",[418,2748,2750],{"id":2749},"evidence-to-keep","Evidence to keep",[91,2752,2753,2754,2757],{},"Export or screenshot the user list and MFA report. Date it. ",[106,2755,2756],{},"This is your baseline"," for next time. Store this user list securely as it contains personal information and details that could help a cyber criminal.",[188,2759,2761],{"id":2760},"step-2-money-paths-30-minutes","Step 2: Money paths - 30 minutes",[91,2763,2764],{},"Review your actual payment process and recent examples:",[144,2766,2767,2777,2798],{},[147,2768,2769,2772,2773,2776],{},[106,2770,2771],{},"How do suppliers change their bank details?"," If the answer is \"by email\", record it as a finding. ",[106,2774,2775],{},"Never accept new or changed payment details without confirming the request through a separate, trusted channel."," For example, call the supplier using a phone number you already have, not a phone number provided in the email.",[147,2778,2779,2782,2783,2786,2787,483,2790,2793,2794,2797],{},[106,2780,2781],{},"Can one person create and approve payments alone?"," Where separation of duties is not practical, use several compensating controls: ",[106,2784,2785],{},"independent verification"," of new or changed payment details, ",[106,2788,2789],{},"bank transaction limits",[106,2791,2792],{},"payment alerts"," and a ",[106,2795,2796],{},"regular review of payments"," by another owner, director or trusted adviser.",[147,2799,2800,2803],{},[106,2801,2802],{},"Does your banking show information about the recipient before you approve a payment?"," This may include an account-name check, PayID name or Confirmation of Payee result. Make sure whoever pays invoices understands the message,but does not use it as a substitute for independently confirming changed payment details.",[188,2805,2807],{"id":2806},"step-3-backups-and-cloud-systems-30-minutes","Step 3: Backups and cloud systems - 30 minutes",[144,2809,2810,2816,2822,2832],{},[147,2811,2812,2815],{},[106,2813,2814],{},"What is actually backed up?"," Name the systems and information your business could not operate without. Examples may include accounting and payroll records, client files, email, customer databases, contracts, website data, source code, project files, important system settings and more. Confirm that each one is included in the backup, not just \"the computer\".",[147,2817,2818,2821],{},[106,2819,2820],{},"Is one backup copy protected?"," A permanently connected drive or a synchronised folder like OneDrive or Google Drive should not be your only backup. Deleted, encrypted, damaged files or ransomware may be synchronised across devices. Check whether your service offers separate version history or recovery features.",[147,2823,2824,2827,2828,2831],{},[106,2825,2826],{},"Restore one real file now."," Pick any recent document from your backup, restore it and open it. ",[106,2829,2830],{},"This may be the highest-value ten minutes of the whole health check",". A backup that has never been tested is only an assumption. If the restore fails, you have discovered the problem before a real emergency.",[147,2833,2834,2837],{},[106,2835,2836],{},"Critical cloud systems."," List the online services your business relies on. Examples may include accounting, payroll, CRM, website hosting and document storage. Confirm who owns each account, who has administrator access, and what recovery or export options are available.",[188,2839,2841],{"id":2840},"step-4-devices-and-updates-30-minutes","Step 4: Devices and updates - 30 minutes",[144,2843,2844,2850,2856,2862,2868,2874],{},[147,2845,2846,2849],{},[106,2847,2848],{},"Is every work computer and phone supported and automatically updating?"," Check whether the operating system is still receiving updates, and whether automatic updates are on. Put anything that no longer receives security updates on the replacement list - it cannot be protected to the same standard as a supported device.",[147,2851,2852,2855],{},[106,2853,2854],{},"Are laptops encrypted?"," Check whether BitLocker on Windows or FileVault on Mac is turned on.",[147,2857,2858,2861],{},[106,2859,2860],{},"Is computer protection working?"," Check that antivirus or other built-in security protection is turned on and up to date.",[147,2863,2864,2867],{},[106,2865,2866],{},"Do devices lock automatically?"," Make sure computers and phones lock after a short period of inactivity and require a strong password, passcode, PIN or biometric sign-in.",[147,2869,2870,2873],{},[106,2871,2872],{},"Does each person have their own login?"," Ensure that staff do not share accounts and do not use an administrator account for everyday work.",[147,2875,2876,2879],{},[106,2877,2878],{},"Lost phones."," If a phone with company email went missing today, could you wipe it remotely? If you don't know, the answer is no.",[188,2881,2883],{"id":2882},"step-5-people-and-paper-30-minutes","Step 5: People and paper - 30 minutes",[144,2885,2886,2892,2904],{},[147,2887,2888,2891],{},[106,2889,2890],{},"Offboarding checklist."," Is there a written checklist removing a departing employee or contractor’s access to every business system? If not, create one using the user list from Step 1.",[147,2893,2894,2897,2898,2900,2901,2903],{},[106,2895,2896],{},"The two rules for staff."," Make sure everyone who works with email or payments knows these rules:",[119,2899],{},"\n1 - Never approve an MFA prompt you didn't request. Repeated unexpected prompts may mean that someone already has your password.",[119,2902],{},"\n2 - Never change suppliers’ bank details based on an email alone. Confirm the changes by calling a trusted phone number you already have.",[147,2905,2906,2909,2910,2915],{},[106,2907,2908],{},"The incident card."," Print one page with your bank's fraud number, the Australian Cyber Security Hotline 1300 CYBER1 (1300 292 371) - it’s available 24\u002F7, and the ",[98,2911,2914],{"href":2912,"rel":2913},"https:\u002F\u002Fwww.cyber.gov.au\u002Freport-and-recover\u002Fwhere-get-help",[102],"ReportCyber"," web address. Also include your cyber insurer and policy number, IT or incident-response provider, legal or privacy adviser, authorised decision-maker, domain registrar and website host. Keep this card somewhere accessible if your systems are unavailable.",[209,2917,2918],{},[91,2919,2920],{},"If you suspect an active incident, stop the health check and seek professional assistance. Do not delete files, messages or logs that may be evidence. Where safe to do so, disconnect an affected computer from Wi-Fi or the network without wiping or resetting it.",[188,2922,2924],{"id":2923},"step-6-official-checks-and-your-findings-20-minutes","Step 6: Official checks and your findings - 20 minutes",[91,2926,2927,2928,2933],{},"Finish with the Australian government’s free and anonymous ",[98,2929,2932],{"href":2930,"rel":2931},"https:\u002F\u002Fwww.cyber.gov.au\u002Fcyberhealthcheck",[102],"Cyber Health Check Tool",". It takes about five minutes and provides simple, tailored suggestions that you can compare with your findings.",[209,2935,2936],{},[91,2937,2938,2939,2944],{},"For a deeper follow-up with your team, use the ACSC's free ",[98,2940,2943],{"href":2941,"rel":2942},"https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fexercise-in-a-box",[102],"Exercise in a Box",".  It provides practical exercises to help you test how your business would respond to a cyber incident.",[91,2946,2947],{},"Turn your notes into an action plan. Use one row for each finding and four columns:",[1550,2949,2950,2974],{},[1553,2951,2952],{},[1556,2953,2954,2959,2964,2969],{},[1559,2955,2956],{},[106,2957,2958],{},"Finding",[1559,2960,2961],{},[106,2962,2963],{},"Risk",[1559,2965,2966],{},[106,2967,2968],{},"Fix",[1559,2970,2971],{},[106,2972,2973],{},"Who \u002F by when",[1570,2975,2976],{},[1556,2977,2978,2981,2984,2987],{},[1575,2979,2980],{},"2 staff accounts do not have MFA",[1575,2982,2983],{},"A stolen password could allow someone to access business email",[1575,2985,2986],{},"Enforce MFA",[1575,2988,2989],{},"Me \u002F Friday",[91,2991,2992,2993,2996],{},"That simple table is the beginning of a practical ",[106,2994,2995],{},"cyber security risk register",". Over time, you can add the severity of the risk, status and date reviewed.",[91,2998,2999,3000,3003],{},"For most small businesses, repeating this ",[106,3001,3002],{},"check every three months"," is a practical starting point. Run it sooner after an employee departure, major system change or suspected incident.",[418,3005,3007],{"id":3006},"prioritise-your-findings-or-what-should-i-fix-first-after-the-health-check","Prioritise your findings, or what should I fix first after the health check?",[91,3009,3010],{},"Deal immediately with any sign of active compromise. Examples may include an unknown administrator, unexplained email forwarding rule, unfamiliar login or unauthorised payment.",[91,3012,3013],{},"For other findings, a practical starting order is:",[1318,3015,3016,3019,3022,3025,3028,3031,3034],{},[147,3017,3018],{},"Protect administrator, email and financial accounts with MFA.",[147,3020,3021],{},"Disable former users who still have access.",[147,3023,3024],{},"Confirm that critical information can be restored from backup.",[147,3026,3027],{},"Strengthen payment verification and approval controls.",[147,3029,3030],{},"Update devices and software.",[147,3032,3033],{},"Replace unsupported devices and software.",[147,3035,3036],{},"Address the remaining findings according to their likely business impact.",[188,3038,3040],{"id":3039},"when-diy-isnt-enough","When DIY isn't enough",[91,3042,3043],{},"This health check can identify common security gaps, but it does not test your systems for technical weaknesses. Seek professional help if there’s a suspected cyber security incident, when important findings remain unfixed, when your business needs technical security testing, or when it holds sensitive or high-risk information such as health records, identity documents, TFNs or financial details.",[91,3045,3046],{},"Most Australian businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but important exceptions apply. For example, some health service providers, businesses that trade in personal information and certain Commonwealth contractors may be covered regardless of turnover.",[91,3048,3049,3050,3055],{},"Check the ",[98,3051,3054],{"href":3052,"rel":3053},"https:\u002F\u002Fwww.oaic.gov.au\u002Fprivacy\u002Fprivacy-guidance-for-organisations-and-government-agencies\u002Forganisations\u002Fsmall-business#section-privacy-checklist-for-small-business",[102],"OAIC’s Small Business Privacy Checklist"," or obtain legal advice if you are unsure whether the Privacy Act applies to your business",[91,3057,3058,3059,3064],{},"When engaging a cyber security provider, ask what framework and assessment method they will use. Depending on your systems and risks, an ",[98,3060,3063],{"href":3061,"rel":3062},"https:\u002F\u002Fwww.cyber.gov.au\u002Fbusiness-government\u002Fasds-cyber-security-frameworks\u002Fessential-eight",[102],"Essential Eight"," assessment - often beginning with Maturity Level One - may provide a structured and comparable baseline.",[418,3066,3068],{"id":3067},"cant-spare-a-whole-afternoon","Can't spare a whole afternoon?",[91,3070,3071],{},"Do the ten-minute version:",[1318,3073,3074,3077,3080],{},[147,3075,3076],{},"Check that MFA protects the owner's email account.",[147,3078,3079],{},"Explain the payment-verification rule to anyone who pays invoices.",[147,3081,3082],{},"Restore one file from backup.",[3084,3085],"hr",{},[91,3087,3088],{},[3089,3090,3091,3092,3095,3096,506],"em",{},"This article is part of our ",[98,3093,3094],{"href":31},"cyber security for small businesses"," series - including ",[98,3097,3099],{"href":3098},"\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms","why hackers target accounting firms",[3084,3101],{},[188,3103,1969],{"id":1968},[144,3105,3106,3109,3112,3115,3118,3121,3124,3127,3130,3133,3136,3139],{},[147,3107,3108],{},"ASD’s ACSC, Cyber Health Check Tool",[147,3110,3111],{},"ASD’s ACSC, Small Business Cyber Security Guide",[147,3113,3114],{},"ASD’s ACSC, Small Business Hub",[147,3116,3117],{},"ASD’s ACSC, Preventing Business Email Compromise",[147,3119,3120],{},"ASD’s ACSC, Review Your Email Account Security",[147,3122,3123],{},"ASD’s ACSC, Exercise in a Box",[147,3125,3126],{},"ASD’s ACSC, Essential Eight",[147,3128,3129],{},"ASD’s ACSC, Cybercrime - getting help",[147,3131,3132],{},"business.gov.au, Cyber Security Checklist",[147,3134,3135],{},"OAIC, Small Business and the Privacy Act",[147,3137,3138],{},"Microsoft Learn, relevant current MFA administration guidance",[147,3140,3141],{},"Google Workspace Admin Help, relevant 2-Step Verification guidance",{"title":25,"searchDepth":1377,"depth":1377,"links":3143},[3144,3147,3148,3149,3150,3151,3154,3157],{"id":2665,"depth":1377,"text":2666,"children":3145},[3146],{"id":2749,"depth":1384,"text":2750},{"id":2760,"depth":1377,"text":2761},{"id":2806,"depth":1377,"text":2807},{"id":2840,"depth":1377,"text":2841},{"id":2882,"depth":1377,"text":2883},{"id":2923,"depth":1377,"text":2924,"children":3152},[3153],{"id":3006,"depth":1384,"text":3007},{"id":3039,"depth":1377,"text":3040,"children":3155},[3156],{"id":3067,"depth":1384,"text":3068},{"id":1968,"depth":1377,"text":1969},"\u002Fcovers\u002Fcyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check.jpg","A practical, jargon-free cyber security checklist you can complete this afternoon to see where your business is exposed - no IT department required.",[3161,3164,3167,3170,3173,3176],{"question":3162,"answer":3163},"Can a small business complete a cyber security health check without an IT provider?","Yes. A business owner or manager can check common risks, including inactive accounts, missing MFA, untested backups, unsupported devices and unsafe payment processes. Please note that a DIY review does not test networks, applications or systems for technical vulnerabilities.",{"question":3165,"answer":3166},"Do I need an IT background to run a cyber security health check?","No. You need admin access to your Microsoft 365 or Google Workspace, your backup system login, and a notepad. Follow the cyber security checklist steps and write down your findings to act on them later.",{"question":3168,"answer":3169},"Is OneDrive or Google Drive a backup?","File synchronisation may help recover earlier files, but a synchronised folder should not be your business’ only backup. Deletions, damaged files or ransomware may be synchronised across devices. Keep a separate protected backup and regularly test that you can restore files from it.",{"question":3171,"answer":3172},"How often should a small business run a cyber security health check?","Every three months is a practical starting point. Run the check sooner if there is a major change, such as a staff departure, the introduction of new software, a change of IT provider or a suspected cyber security incident.",{"question":3174,"answer":3175},"Is there a free government cyber security assessment for small businesses?","Yes. The Cyber Health Check Tool on cyber.gov.au is free and anonymous. It provides tailored suggestions based on your answers. The ACSC's free Exercise in a Box can help your team practice responding to realistic cyber incident scenarios.",{"question":3177,"answer":3178},"When should a business get professional cyber security help?","Seek professional help after a suspected cyber security incident, when important security issues remain unresolved, when a technical testing is required, or when your business holds sensitive or high-risk information, such as health records, identity documents, tax file numbers or financial details. Most Australian small businesses with annual turnover of $3 million or less are not covered by the Privacy Act, but important exceptions apply. Obtain privacy or legal advice if you are unsure whether the Privacy Act applies to your business.",{},{"description":3181,"title":3182},"A plain-English cyber security checklist Australian small businesses can complete themselves, with practical steps and no IT department required.","DIY Cyber Security Health Check for Small Business","Reviewed against current guidance from ASD’s Australian Cyber Security Centre, business.gov.au, the OAIC, Microsoft and Google",{"title":2635,"description":3159},{"loc":37},"cyber-security\u002Fsmall-business\u002Fdiy-cyber-security-health-check",[48,3188],"Small Business","Nhqi3lLVSDN8wAzFS-1zxT1E-fupXjMiRnQ7gSAcOXw",{"id":3191,"title":3192,"authorBio":3193,"body":3194,"coverImage":3667,"date":2031,"description":3668,"extension":1402,"faq":3669,"heroImage":3667,"lastReviewed":86,"meta":3682,"metadata":3683,"navigation":1418,"path":3098,"readingTime":3685,"reviewedAgainst":3686,"seo":3687,"sitemap":3688,"stem":3689,"summary":3690,"tags":3691,"thumbnail":3667,"__hash__":3692},"blog\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms.md","Why Hackers Target Accounting Firms and How to Reduce the Risk","Written by Elena Osipova, CPA and emerging cyber security practitioner. Drawing on her accounting and business experience, Elena writes about cyber security governance, real-world incidents and practical security controls for Australian small businesses.",{"type":88,"value":3195,"toc":3655},[3196,3199,3202,3205,3208,3211,3215,3218,3263,3266,3269,3272,3276,3279,3282,3291,3295,3298,3318,3321,3325,3328,3332,3335,3367,3371,3374,3509,3513,3519,3525,3531,3537,3542,3546,3603,3606,3608],[91,3197,3198],{},"In May 2025, the Qilin ransomware group listed Melbourne accounting practice MKA Accountants on its darknet leak site. The group published 12 sample documents it claimed were taken from the firm, including financial statements, insurance information and internal correspondence.",[91,3200,3201],{},"MKA Accountants confirmed that it was investigating unauthorised access and had notified clients and relevant authorities, including the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC). Later reports said Qilin claimed to have released more than 185GB of data, although the exact volume was not independently confirmed.",[91,3203,3204],{},"In May 2026, Brisbane accounting firm Kennedy McLaughlin & Associates confirmed unauthorised access to part of its IT environment after the same ransomware group listed it on their darknet leak site. Cyber Daily reported that a dataset containing client financial details and banking information appeared to have been published. The firm said it had notified affected individuals, the ACSC and the OAIC about this incident.",[91,3206,3207],{},"These were not large organisations. They were local accounting practices - the kind of businesses that hold tax and financial records, payroll and identity document information for many clients.",[91,3209,3210],{},"That set of valuable information is exactly what makes accounting firms attractive targets to cyber criminals.",[188,3212,3214],{"id":3213},"why-accounting-firms-are-valuable-targets","Why accounting firms are valuable targets",[91,3216,3217],{},"Cybercriminals may target an accounting firm for money, but the greater attraction is often the client information and trusted access the firm holds for every client, going back years. This may include:",[144,3219,3220,3225,3230,3235,3241,3247,3252,3257],{},[147,3221,3222],{},[106,3223,3224],{},"Tax file numbers",[147,3226,3227],{},[106,3228,3229],{},"Bank account details",[147,3231,3232],{},[106,3233,3234],{},"Financial statements",[147,3236,3237,3240],{},[106,3238,3239],{},"Payroll data"," such as clients’ employee names, addresses, salaries, bank and superannuation details",[147,3242,3243,3246],{},[106,3244,3245],{},"Identity documents information"," collected for verification",[147,3248,3249],{},[106,3250,3251],{},"Director ID numbers",[147,3253,3254],{},[106,3255,3256],{},"Trust, company and superannuation fund account details",[147,3258,3259,3262],{},[106,3260,3261],{},"Tax and lodgement access information"," like practice-management software, online services for agents, myID-linked access and authorisations that allow staff to act for their clients.",[91,3264,3265],{},"Together, these records can provide enough information for identity theft, tax fraud, and various elaborate, targeted scams.",[91,3267,3268],{},"Accounting and professional service firms are regularly affected by reportable data breaches. In 2025, the OAIC received 1,205 data breach notifications. Legal, accounting and management services accounted for 81 notifications, or approximately 6.7% of the total. This placed the combined sector among the five highest by notification volume.",[91,3270,3271],{},"The information held by accountants for their clients can be used for identity crime, refund fraud and highly convincing scams.",[188,3273,3275],{"id":3274},"what-information-attackers-want","What information attackers want",[91,3277,3278],{},"A stolen TFN isn't just sold once - it's put to work. Cybercriminals have used stolen identities to create fake myGov accounts, link them to real taxpayers' ATO records, then lodge fraudulent tax returns and activity statements and redirect the refunds.",[91,3280,3281],{},"In the two years to February 2023, the ATO cancelled more than 37,000 fraudulent tax returns and business activity statements with a claimed value of $557.8 million. This affected more than 15,000 taxpayers. Some claims were stopped before payment, and the ATO could not attribute the entire amount of claims to a single fraud method.",[91,3283,3284,3285,3290],{},"In February 2024, the ATO said it was defending its websites, services and infrastructure against an average of 4.7 million attempted cyber attacks each month. The ATO maintains the dedicated ",[98,3286,3289],{"href":3287,"rel":3288},"https:\u002F\u002Fwww.ato.gov.au\u002Fonline-services\u002Fscams-cyber-safety-and-identity-protection\u002Fhelp-with-data-breaches\u002Fdata-breach-guidance-for-tax-professionals",[102],"data breach guidance for tax professionals"," so firms can report incidents quickly when client identities, tax information or agent access may have been compromised.",[188,3292,3294],{"id":3293},"how-cyber-attacks-commonly-happen","How cyber attacks commonly happen",[91,3296,3297],{},"Three common attack paths show how a cyber incident may unfold:",[1318,3299,3300,3306,3312],{},[147,3301,3302,3305],{},[106,3303,3304],{},"Phishing and email takeover."," An employee receives a convincing email prompting them to enter their username and password on a fake but look-alike Microsoft 365 login page. The attacker gets the access and reads the mailbox for weeks, downloads client records, and uses the trusted address to send invoice-redirection emails to clients.",[147,3307,3308,3311],{},[106,3309,3310],{},"Ransomware with data theft."," An attacker gains access, quietly copies information, may then encrypt systems before threatening to publish the stolen data. The MKA Accountants and Kennedy McLaughlin & Associates incidents were publicly associated with this type of attack. Paying a ransom does not guarantee that stolen data will be deleted or kept private.",[147,3313,3314,3317],{},[106,3315,3316],{},"Credential theft against practice software and portals."," Stolen logins for practice management systems or lodgement services give cybercriminals the same reach the practice has - across every client at once.",[91,3319,3320],{},"Highly sophisticated hacking is not always required. Many incidents begin with a stolen password, a phishing message, an unpatched system or access that should have been removed.",[188,3322,3324],{"id":3323},"what-a-breach-can-cost","What a breach can cost",[91,3326,3327],{},"In 2024-25, the average self-reported financial loss per cybercrime report from a small business was approximately $56,600, 14% higher than the previous year.",[188,3329,3331],{"id":3330},"legal-and-professional-obligations","Legal and professional obligations",[91,3333,3334],{},"For an accounting practice, stolen money and ransomware demands are only the beginning. A data breach triggers a stack of obligations that most other small businesses never face. These may include:",[144,3336,3337,3343,3349,3355,3361],{},[147,3338,3339,3342],{},[106,3340,3341],{},"Privacy Act and Notifiable Data Breaches scheme."," Many small accounting practices are TFN recipients and may have Privacy Act obligations for the TFN information they hold, even when annual turnover is $3 million or less. They must notify the OAIC and affected individuals when the breach meets the legal test for an eligible data breach, including that it is likely to cause serious harm.",[147,3344,3345,3348],{},[106,3346,3347],{},"Tax Practitioners Board."," Registered tax practitioners must report a significant breach of the Code of Professional Conduct to the TPB within 30 days of when they know, or ought to know that the breach occurred. A cyber incident may trigger this obligation if it involves a significant breach of duties such as client confidentiality or causes, or is likely to cause material loss or damage. Whether reporting is required depends on the circumstances.",[147,3350,3351,3354],{},[106,3352,3353],{},"ATO notification."," Where client identities, TFNs, tax records or agent access may have been compromised, accounting firms should promptly contact the ATO, so it can assess and apply appropriate protections.",[147,3356,3357,3360],{},[106,3358,3359],{},"Professional standards."," Members of professional accounting bodies, such as CPA Australia, may also have confidentiality obligations under APES 110, the Code of Ethics for Professional Accountants. Registered tax practitioners have separate confidentiality obligations under the TPB Code of Professional Conduct. A failure to take reasonable safeguards may also raise professional and ethical issues, depending on the circumstances.",[147,3362,3363,3366],{},[106,3364,3365],{},"Reputational damage and client attrition."," Clients trust their accountants with everything. A public data leak can cause lasting damage to client trust and the firm’s reputation.",[188,3368,3370],{"id":3369},"controls-that-reduce-the-risk","Controls that reduce the risk",[91,3372,3373],{},"The following controls help reduce the risks discussed above. And most of them are low effort.",[1550,3375,3376,3395],{},[1553,3377,3378],{},[1556,3379,3380,3385,3390],{},[1559,3381,3382],{},[106,3383,3384],{},"Control",[1559,3386,3387],{},[106,3388,3389],{},"Risk it reduces",[1559,3391,3392],{},[106,3393,3394],{},"Effort",[1570,3396,3397,3408,3418,3429,3439,3449,3459,3469,3479,3489,3499],{},[1556,3398,3399,3402,3405],{},[1575,3400,3401],{},"MFA on email, practice software and tax-related accounts",[1575,3403,3404],{},"Account takeover after password theft",[1575,3406,3407],{},"Low",[1556,3409,3410,3413,3416],{},[1575,3411,3412],{},"Password manager and strong, unique passwords",[1575,3414,3415],{},"Password reuse and credential-stuffing attacks",[1575,3417,3407],{},[1556,3419,3420,3423,3426],{},[1575,3421,3422],{},"Protected backup copy",[1575,3424,3425],{},"Loss of all recoverable copies during ransomware",[1575,3427,3428],{},"Medium",[1556,3430,3431,3434,3437],{},[1575,3432,3433],{},"Segregation of payment duties and independent verification of changed payment details",[1575,3435,3436],{},"Invoice and payment-redirection fraud",[1575,3438,3407],{},[1556,3440,3441,3444,3447],{},[1575,3442,3443],{},"Practical staff training on phishing, unexpected MFA prompts and payment changes",[1575,3445,3446],{},"Staff responding to phishing, unexpected MFA prompts and approving fake payment requests",[1575,3448,3407],{},[1556,3450,3451,3454,3457],{},[1575,3452,3453],{},"Automatic security updates on operating systems and practice software",[1575,3455,3456],{},"Exploitation of known vulnerabilities in unpatched software",[1575,3458,3407],{},[1556,3460,3461,3464,3467],{},[1575,3462,3463],{},"Regular access reviews and offboarding checklist for staff",[1575,3465,3466],{},"Unnecessary access and active former-staff access",[1575,3468,3407],{},[1556,3470,3471,3474,3477],{},[1575,3472,3473],{},"Regular review of third-party, contractor and connected-app access",[1575,3475,3476],{},"Unnecessary access by old providers, contractors or connected apps",[1575,3478,3428],{},[1556,3480,3481,3484,3487],{},[1575,3482,3483],{},"Sign-in and administrator alerts",[1575,3485,3486],{},"Undetected misuse of compromised accounts",[1575,3488,3428],{},[1556,3490,3491,3494,3497],{},[1575,3492,3493],{},"Data retention and secure deletion",[1575,3495,3496],{},"Unnecessary exposure of old client records and identity documents",[1575,3498,3428],{},[1556,3500,3501,3504,3507],{},[1575,3502,3503],{},"Tested incident-response plan",[1575,3505,3506],{},"Delayed containment and missed reporting steps",[1575,3508,3428],{},[418,3510,3512],{"id":3511},"four-controls-worth-a-closer-look","Four controls worth a closer look",[91,3514,3515,3518],{},[106,3516,3517],{},"Review what you keep."," Retain records for the periods required by law and professional standards, but securely delete duplicate files, outdated identity documents and other information when there is no longer legal, professional or business reason to keep it. Holding less unnecessary information reduces the potential impact of a breach.",[91,3520,3521,3524],{},[106,3522,3523],{},"Review connected services."," Check which cloud platforms, software integrations, contractors and service providers can access client information. Remove unused and unnecessary connections, confirm who has administrator access and understand how each provider protects and backs up your data.",[91,3526,3527,3530],{},[106,3528,3529],{},"Train staff on real warning signs."," Make sure employees know how to recognise suspicious login pages, unexpected MFA prompts and urgent payment requests. They should know who to contact and what to do before clicking, approving a prompt or making a payment.",[91,3532,3533,3536],{},[106,3534,3535],{},"Protect at least one backup copy."," Keep one backup offline, immutable or otherwise protected from normal user accounts and devices. Test regularly that important files can be restored from it.",[91,3538,1961,3539,3541],{},[98,3540,1964],{"href":37}," for a structured review of your accounts, payments, backups, devices and business processes.",[188,3543,3545],{"id":3544},"five-actions-to-take-this-week","Five actions to take this week",[1318,3547,3548,3554,3573,3579,3585],{},[147,3549,3550,3553],{},[106,3551,3552],{},"Turn on MFA"," for every supported business account, beginning with email, administrator, financial and tax-related accounts. Where available, use phishing-resistant methods like passkeys or security keys.",[147,3555,3556,3559],{},[106,3557,3558],{},"Give staff two clear rules:",[1318,3560,3561,3567],{},[147,3562,3563,3566],{},[106,3564,3565],{},"Never approve an MFA prompt they did not request",". An unexpected prompt may mean someone is trying to access the account.",[147,3568,3569,3572],{},[106,3570,3571],{},"Never change payment details based on an email alone",". Confirm the request by calling a trusted phone number already held by the firm.",[147,3574,3575,3578],{},[106,3576,3577],{},"Enable automatic security updates where supported."," Keep computers, servers, browsers, practice software, remote access tools and internet-facing devices protected against known vulnerabilities.",[147,3580,3581,3584],{},[106,3582,3583],{},"Review your user list."," Check every account and access role. Promptly disable accounts belonging to former staff. Treat any unknown or suspicious account as urgent.",[147,3586,3587,3590,3591,3594,3595,3598,3599,3602],{},[106,3588,3589],{},"Print your incident contacts."," Include the ATO's ",[98,3592,3289],{"href":3287,"rel":3593},[102],", the OAIC, the TPB, ",[98,3596,2914],{"href":2912,"rel":3597},[102]," and the Australian Cyber Security Hotline ",[106,3600,3601],{},"1300 CYBER1 (1300 292 371)",". You should also include your IT or incident-response provider; cyber insurer and policy number; legal or privacy adviser; authorised decision-maker.",[91,3604,3605],{},"Cybercriminals target accounting firms because the information and access they hold can be highly valuable. The good news is that you can strengthen your defences  with basic, consistent controls to make many common attack paths much harder.",[188,3607,1969],{"id":1968},[144,3609,3610,3613,3616,3619,3622,3625,3628,3631,3634,3637,3640,3643,3646,3649,3652],{},[147,3611,3612],{},"ASD, Annual Cyber Threat Report 2024-25",[147,3614,3615],{},"OAIC, Data breach notifications increase to all-time high in 2025",[147,3617,3618],{},"OAIC, Quick reference guide for responding to data breaches",[147,3620,3621],{},"OAIC, The Privacy (Tax File Number) Rule 2015 and the protection of TFN information",[147,3623,3624],{},"ATO, Agent checklist for client-to-agent linking process",[147,3626,3627],{},"ATO, Accessing Online services for agents",[147,3629,3630],{},"ATO, Data breach guidance for tax professionals",[147,3632,3633],{},"Australian Government, Privacy (Tax File Number) Rule 2015",[147,3635,3636],{},"TPB, Breach reporting obligations;",[147,3638,3639],{},"TPB, Protect your practice from cyber-attacks",[147,3641,3642],{},"TPB, Debunking myths about breach reporting",[147,3644,3645],{},"iTnews, ATO attackers filed $557 million in false claims",[147,3647,3648],{},"Cyber Daily, MKA Accountants confirms Qilin ransomware attack",[147,3650,3651],{},"Cyber Daily, Kennedy McLaughlin confirms cyber incident",[147,3653,3654],{},"ABC, Outgoing ATO boss says getting rid of work-related tax deductions would be a 'big step'",{"title":25,"searchDepth":1377,"depth":1377,"links":3656},[3657,3658,3659,3660,3661,3662,3665,3666],{"id":3213,"depth":1377,"text":3214},{"id":3274,"depth":1377,"text":3275},{"id":3293,"depth":1377,"text":3294},{"id":3323,"depth":1377,"text":3324},{"id":3330,"depth":1377,"text":3331},{"id":3369,"depth":1377,"text":3370,"children":3663},[3664],{"id":3511,"depth":1384,"text":3512},{"id":3544,"depth":1377,"text":3545},{"id":1968,"depth":1377,"text":1969},"\u002Fcovers\u002Fcyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms.jpg","Learn why accounting firms attract cybercriminals and the practical steps small practices can take to protect client data and reduce cyber risk.",[3670,3673,3676,3679],{"question":3671,"answer":3672},"Why would hackers target a small accounting firm instead of a big company","A small accounting firm may hold the same kinds of valuable client information as a big company, including TFNs, payroll records, bank details and identity documents. At the same time, smaller firms may have fewer dedicated IT and security resources. This combination can make them attractive to cybercriminals.",{"question":3674,"answer":3675},"Does the Privacy Act apply to my accounting practice if turnover is under $3 million?","Under the Privacy (Tax File Number) Rule 2015, many accounting practices with annual turnover of $3 million or less still have Privacy Act obligations because they receive and hold TFN information. If a breach is likely to cause serious harm, the practice may need to notify the OAIC and affected individuals under the Notifiable Data Breaches scheme. Other Privacy Act exceptions may also apply. Obtain legal or privacy advice for your circumstances.",{"question":3677,"answer":3678},"What is the single most effective protection for an accounting firm?","Multi-factor authentication (MFA) is one of the most important protections for administrator, email, practice management software and tax-related accounts. It adds another layer of protection when a password is stolen or phished.",{"question":3680,"answer":3681},"What should an accounting firm do immediately after discovering a data breach?","Where safe and appropriate, disconnect an affected computer from Wi-Fi or the network without wiping or resetting it, and seek qualified IT or incident-response support. Contact the ATO promptly if client tax information or agent access may be affected. The firm should then assess its notification obligations. These may include notifying the OAIC and affected individuals under the Notifiable Data Breaches scheme, the TPB where a significant Code of Professional Conduct breach may have occurred; professional associations, insurers, and other affected parties",{},{"description":3668,"title":3684},"Why Hackers Target Accounting Firms & How to Reduce the Risk",9,"Reviewed against current guidance from ASD’s Australian Cyber Security Centre, the OAIC, business.gov.au, the ATO and TPB",{"title":3192,"description":3668},{"loc":3098},"cyber-security\u002Fsmall-business\u002Fwhy-hackers-target-accounting-firms","Accounting firms hold the keys to their clients' finances - which is exactly why they're such an attractive target for cybercriminals. Here's what makes them vulnerable, and how to close the cyber security gaps.",[48,3188],"JKrfW2SpuQSHKmIm97ylyA-qvnCXZppsJchpqGZpN5c",1785205144728]