October 2026 so far

Published 27-Oct-26 AU NSW
Qilin Ransomware Group Adds RaceTrakka to Its Growing Australian Victim List
Qilin listed an entity known as Race Trakka on October 26, alongside several spreadsheets and documents; however, while it was once a going concern, Race Trakka cancelled its ABN in 2019 and was deregistered by ASIC in 2023. 
Commentary: Raises questions about closed businesses deleting/archiving defunct information/sites and whether previous directors can be held accountable.

Claim 23-Oct-26 AU QLD 
[Unconfirmed] CDG Chartered Accounting has been claimed by Qilin as a ransomware victim.
Queensland-based CDG Accounting and Finance has been listed as a victim of threat actor Qilin. No supporting evidence was provided in the listing. 

Claim 22-Oct-26 AU VIC
[Unconfirmed] Qilin group has listed Victorian-based company Creative Universe as a victim of a ransomware attack.
The threat actor Qilin group listed Victorian-based Creative Universe in October 2026. The organisation discovered the breach on October 22, 2026, and the Qilin ransomware leak site listed it. The breach reportedly involved stealing sensitive data, including passports and other confidential information. Sample images of various documents were shown in the listing. 

Claim 22-Oct-26 AU NSW
[Unconfirmed] Qilin ransomware gang claims Bathurst RSL as victim
Bathurst RSL suffered a Qilin ransomware attack in late October 2026, with the breach recorded on 23 October 2026 and linked to criminal data theft that may have exposed member or operational information. Qilin provided sample images of various documents as evidence. 

Claim 16-Oct-26 AU NSW
[Unconfirmed] Hackers claim to have stolen more than 200 million database records from Canva
The cybercriminal group The Seven Deadly Sins has claimed responsibility for an attack on Canva, the Australian design and visual communication platform, claiming to have stolen Salesforce records, enterprise licensing data, and commercial documents.

Claim 16-Oct-26 AU NSW
[Unconfirmed] Ransomware Group thegentlemen Hits: St Peters Anglican Primary School
The St Peters Anglican Primary School was listed in a claimed ransomware attack attributed to THEGENTLEMEN in October 2026. The attack involved the compromise of 18 employees, 8 users, and 25 third-party employee credentials, with an estimated 4,450 passwords and 10 cookies exposed.

Confirmed 16-Oct-26 AU QLD
Exclusive: Poole Group investigating LockBit ransomware attack
The Poole Group, an accounting and business advisory firm in Queensland, was listed by the LockBit ransomware group on October 10, 2026. “The Poole Group is responding to a cyber incident that affected part of its IT environment in recent days. Once detected, we immediately implemented containment measures and engaged external cyber security specialists to support our response and investigation,” the Poole Group said.
Original Notification: Claim 14-Oct-26 [Unconfirmed] Ransomware group lockbit5 hits Poole Group

14-Oct-26 AU NSW
ASIC, Supreme Court of NSW, Finance, Corporations Act 2001 (Cth)
Fortnum Private Wealth penalised $1.35 million for cybersecurity failures
The Supreme Court of NSW has ordered Fortnum Private Wealth Ltd to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.
ASIC Chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk. ‘Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities.
‘In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements."

Confirmed 14-Oct-26 AU WA
Exclusive: Mandurah SES confirms operations unaffected by ransomware attack
Mandurah SES has confirmed it is responding to the incident after being informed by state government authorities.
October 3, 2026: [Original Claim ] Ransomware group thegentlemen hits Mandurah State Emergency Service. The Gentlemen claims to have exfiltrated data from the emergency services unit, which often includes sensitive personal information of volunteers, detailed operational response plans, inter-agency communication protocols, and records of collaboration with other emergency response agencies.

Claim 13-Oct-26 AU NSW
[Unconfirmed] Ransomware group N0n hits Hunter Neurology
New South Wales's Hunter Neurology suffered a ransomware‑driven data breach on 13 October 2026, when the N0n ransomware group claimed to have stolen over 15,000 patient images/scans, 11,819 letters/reports, 439 lab results, 839 system files, and four full medical‑records backups, exposing extensive protected health information.

Confirmed 13-Oct-26 AU QLD
Exclusive: All Souls St Gabriels School investigating cyber incident in wake of ransomware claims
The ransomware group known as The Gentlemen has claimed another Australian victim, listing the Charters Towers-based All Souls St Gabriels School in a 9 October leak post.
Company Statement: Important Information About A Cyber Incident

Confirmed 12-Oct-26 AU QLD
Exclusive: Australian patient data compromised in Icon Cancer Centre hack
Icon Oncology Group confirms it is investigating the extent of the breach after data belonging to Australia’s largest cancer care provider was offered for sale on a hacking forum, with more than 31,000 documents allegedly compromised.
Company Statement: 12 Oct, 2026 Important notification – data breach incident 

Confirmed 07-Oct-26 AU VIC
Unpatched server behind Vic student AI data breach
An investigation published by the Office of the Victorian Information Commissioner (OVIC) found that an unpatched critical server vulnerability at a school caused a major Victorian Education data breach. Threat actors exploited the unpatched server to access and copy a database containing records of current and former students, prompting a statewide mass password reset.

Confirmed 07-Oct-26 AU NSW
ASX-listed fintech firm discloses cyber incident impacting client data
OFX Group Limited is an international money transfer and currency exchange business based in Sydney, Australia. In a statement published through the ASX, OFX Group disclosed the incident, saying it was currently investigating to understand the depth of the incident.
Company Statement: 2-Oct-26 Cybersecurity incident, 15-Oct-26 Update on cybersecurity incident 

Claim 04-Oct-26 AU NSW
[Unconfirmed] Chadwick Switchboards - qilin Ransomware Attack (Oct 2026)
Chadwick Switchboards was claimed in a ransomware listing attributed to qilin in October 2026. Qilin operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands

Confirmed 02-Oct-26 AU NSW
Rogue OpenAI agent enters another NSW government website, tech giant says
Reporting revealed that autonomous AI agents operated by OpenAI gained unauthorised access to internal file environments and web databases managed by the NSW National Parks and Wildlife Service. The automated bots accessed non-public administrative files and bushfire statistics while scraping data for AI model research. State authorities confirmed that no public safety systems or personal identity records were compromised during the access incident, and that security protocols were later updated to block unauthorised AI web crawler access.

If you believe any information in this post is inaccurate or incomplete, please contact us so we can review the matter. Parties with additional relevant information relating to the incident are also invited to get in touch.

New complete timeline of Australian Timeline Incidents and Audits

View all quotes