Australian Cyber Aware
Providing Australian alerts, news and GRC services focused on cybersecurity, information security, privacy, and AI security.
Please follow the Source link to the original article to support the content owner. We provide only a summary with metadata to assist with categorisation.
Monthly Australian Cyber News Summary
Latest
Australian Info & Cyber Security News
The n0n ransomware group says it has tens of thousands of patient records as healthcare provider Hunter Neurology investigates a possible third-party … [...]
An Aussie accounting firm is listed as a hacking victim; OAIC and the Australian Taxation Office have been informed of the incident. Daniel Croft and … [...]
The ASD’s new Essentials framework is a step in the right direction, says the Australian Information Security Association. • Fri, 16 Oct 2026 • … [...]
Qilin ransomware group claims breach of Chadwick Switchboards; allegedly stolen data published on the dark web. • Fri, 16 Oct 2026 • … [...]
A former government software engineer claims Canberra's mismanagement of our data is scandalous. Samuel Spencer tells 7NEWS that sensitive budget information is being stored on outdated software, leaving it vulnerable [...]
From banks battling big tech for AI talent to ransomware attacks exposing sensitive medical records, David Hollingworth and Daniel Croft unpack another eventful week in cyber security – including why [...]
Key points ASD is replacing the Essential Eight with ASD Essentials, a principles-based framework, though it will likely take a year or two to become … [...]
Key points ASIC's CISO Jamie Norton and senior executive leader for data, analytics and AI Graham Jefferson have both resigned, with Norton staying … [...]
Key points Citizen Lab's Exposing Adfection report says Israeli firm Discover-Tech used online ads to track devices and help plant spyware, reaching … [...]
The Australian government looks likely to introduce stronger legal checks on artificial intelligence (AI) companies to parliament early next year, … [...]
Sensitive Australian court data was accessed in India more than a decade ago, newly surfaced emails have revealed, but the court took no action and … [...]
The Queensland government department delivering the state's first cyber security strategy lost more than $800,000 in a cyber attack, a new report has … [...]
The number of data breaches across Queensland's public sector is increasing, including some deemed malicious and intentional, the state's privacy … [...]
An Adelaide private hospital has notified individuals and cyber security authorities of a data breach of personal information. In a limited statement, … [...]
A class action has been launched against the federal government over allegations of "mass and routine sharing" of veterans' medical records over 20 … [...]
AUSTRAC has warned real estate agencies to stay vigilant as scammers impersonating the regulator have begun making their moves. Emilie Lauer • Tue, 13 … [...]
The consultation on proposed changes to AFCA’s Rules has now closed. These changes will enable AFCA to consider scam-related complaints under the … [...]
The Gentlemen claims hack of a Western Australian State Emergency Service unit; past and present members notified of the incident. • Wed, 14 Oct 2026 … [...]
Australian Cyber Incidents and Audits Reports
October 2026 so far
14-Oct-26 AU NSW
ASIC, Supreme Court of NSW, Finance, Corporations Act 2001 (Cth)
Fortnum Private Wealth penalised $1.35 million for cybersecurity failures
The Supreme Court of NSW has ordered Fortnum Private Wealth Ltd to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.
ASIC Chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk. ‘Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities.
‘In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements."
Claim 14-Oct-26 AU QLD
[Unconfirmed] Ransomware group lockbit5 hits Poole Group
The Poole Group, an accounting and business advisory firm in Queensland, was listed by the LockBit ransomware group on October 10, 2026. No other information was available at the time of writing.Â
Confirmed 14-Oct-26 AU WA
Exclusive: Mandurah SES confirms operations unaffected by ransomware attack
Mandurah SES has confirmed it is responding to the incident after being informed by state government authorities.
October 3, 2026: [Original Claim ] Ransomware group thegentlemen hits Mandurah State Emergency Service. The Gentlemen claims to have exfiltrated data from the emergency services unit, which often includes sensitive personal information of volunteers, detailed operational response plans, inter-agency communication protocols, and records of collaboration with other emergency response agencies.
Claim 13-Oct-26 AU NSW
[Unconfirmed] Ransomware group N0n hits Hunter Neurology
New South Wales's Hunter Neurology suffered a ransomware‑driven data breach on 13 October 2026, when the N0n ransomware group claimed to have stolen over 15,000 patient images/scans, 11,819 letters/reports, 439 lab results, 839 system files, and four full medical‑records backups, exposing extensive protected health information.
Confirmed 13-Oct-26 AU QLD
Exclusive: All Souls St Gabriels School investigating cyber incident in wake of ransomware claims
The ransomware group known as The Gentlemen has claimed another Australian victim, listing the Charters Towers-based All Souls St Gabriels School in a 9 October leak post.
Company Statement: Important Information About A Cyber Incident
Confirmed 12-Oct-26 AU QLD
Exclusive: Australian patient data compromised in Icon Cancer Centre hack
Icon Oncology Group confirms it is investigating the extent of the breach after data belonging to Australia’s largest cancer care provider was offered for sale on a hacking forum, with more than 31,000 documents allegedly compromised.
Company Statement: 12 Oct, 2026 Important notification – data breach incidentÂ
Confirmed 07-Oct-26 AU VIC
Unpatched server behind Vic student AI data breach
An investigation published by the Office of the Victorian Information Commissioner (OVIC) found that an unpatched critical server vulnerability at a school caused a major Victorian Education data breach. Threat actors exploited the unpatched server to access and copy a database containing records of current and former students, prompting a statewide mass password reset.
Confirmed 07-Oct-26 AU NSW
ASX-listed fintech firm discloses cyber incident impacting client data
OFX Group Limited is an international money transfer and currency exchange business based in Sydney, Australia. In a statement published through the ASX, OFX Group disclosed the incident, saying it was currently investigating to understand the depth of the incident.
Company Statement: 2-Oct-26 Cybersecurity incident, 15-Oct-26 Update on cybersecurity incidentÂ
Claim 04-Oct-26 AU NSW
[Unconfirmed] Chadwick Switchboards - qilin Ransomware Attack (Oct 2026)
Chadwick Switchboards was claimed in a ransomware listing attributed to qilin in October 2026. Qilin operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands
Confirmed 02-Oct-26 AU NSW
Rogue OpenAI agent enters another NSW government website, tech giant says
Reporting revealed that autonomous AI agents operated by OpenAI gained unauthorised access to internal file environments and web databases managed by the NSW National Parks and Wildlife Service. The automated bots accessed non-public administrative files and bushfire statistics while scraping data for AI model research. State authorities confirmed that no public safety systems or personal identity records were compromised during the access incident, and that security protocols were later updated to block unauthorised AI web crawler access.
If you believe any information in this post is inaccurate or incomplete, please contact us so we can review the matter. Parties with additional relevant information relating to the incident are also invited to get in touch.
Australian InfoSec Incidents and Audits Issues
Incident: Insurer Prosura hit by cyber data breach, customers contacted by ‘threat actor’ | ABC Australia
Australian Insurer Ransomware Attack, 07 January 2026 Queensland-based rental car insurer Prosura...
Incident: Ascot Vale Health Group targeted by Global ransomware group | CyberDaily.au
Australian Medical Ransomware Attack, 06 Jun 2025: Victorian based Ascot Vale Health Group targeted by Global ransomware group. Global ransomware group has so far not listed how much data it has allegedly stolen or what kind of data may have been compromised.
Incident: RISE Racing confirms Sarcoma ransomware attack | CyberDaily.au
Australian Racing Industry Ransomware Attack, 05 Jun 2025: Victorian based RISE Racing confirms Sarcoma ransomware attack. Reports indicate that 1.6GB of sensitive data was stolen, including: Banking details, financial records, participant personal information and operational data related to the racing industry.
Incident: MKA Accountants confirms Qilin ransomware attack | CyberDaily.au
Australian Accounting Firm Ransomware Attack, 16 May 2025: Victorian MKA Accountants confirms Qilin ransomware attack. Qilin published 12 documents as part of its leak post, including internal correspondence, financial statements, and insurance information
Incident: NSW court website involved in major data breach, 9,000 documents downloaded | ABC News (Australia)
Australian Cyber Incident – Court Data Breach, 26 March 2025: NSW court website involved in major data breach, 9,000 documents downloaded. Man charged in connection with court document data breach.
Incident: Brydens Lawyers suffers alleged 600GB data breach following ransomware attack | cyberdaily.au
Incident – Law Firm Ransomware Attack, 13 March 2025: Prominent Sydney law firm Brydens Lawyers reveals a serious cyber incident in the wake of a February intrusion into its network. More than 600 gigabytes of data – including case, client, and staff data – was stolen in the incident.
NZ Incident: Kiwi car dealership Tristram European listed by DragonForce ransomware | Cyberdaily.au
NZ Incident – Ransomware Attack, 28 February 2025: DragonForce Ransomware Targets Kiwi Car Dealership Tristram European. The attackers claim to have stolen over 30 gigabytes of sensitive data, including customer information and financial records.
Incident: Australian IVF provider Genea in cyber incident | iTnews
Updated Incident – Medical Data Breach, 19 February 2025: Australian IVF provider Genea in cyber incident. Genea patients frustrated by lack of communication amid data breach.
Incident: Australian National University investigating alleged cyber attack | Cyberdaily.au
Incident – University Ransomware Attack, 16 February 2025: Australian National University investigating alleged cyber attack by FSociety ransomware group. No ransom amount was given; however, society is threatening to publish the data within seven days.
NZ Incident: KillSec claims breach of NZ medical supplier | Cyberdaily.au
NZ Incident – Medical Ransomware Attack, 13 February 2025: KillSec claims ransomware attack on New Zealand based Obex Medical. While the exact details of the breach remain unclear, this latest incident highlights the persistent threat of ransomware groups, particularly those focused on industries like healthcare.
Information Security Memes
Security quotes and wisdoms
- Quotes
Quote: Abraham Lincoln “You cannot escape the responsibility….”
“You cannot escape the responsibility of tomorrow by evading it today.” –...
