Australian Cyber Aware – As It Was 2608 – August 2026
A monthly review of Australian and New Zealand cyber security incidents, data breaches, privacy reform, AI governance developments, audit findings, scams, and regulatory updates for August 2026.
Australian Cyber Aware
Providing Australian and New Zealand news and services on cybersecurity, information security, privacy, and AI security.
Vendor-neutral, press release-free, and advertisement-free.
Please follow the Source link to the original article to support the content owner. We only provide a summary with metadata to assist in categorisation.
Australian Info & Cyber Security News
Hackers have published employee driver’s licenses, tax file numbers, and customer correspondence, with more data to come. • Fri, 18 Sep 2026 • Security … [...]
Canberra is looking for feedback on its approach to AI and its infrastructure in Australia, from data centre growth to consumer costs. • Fri, 18 Sep … [...]
Key points Optus is discussing cyber security policies that could regulate or even ban smart glasses in its stores and offices. • EGM security and risk … [...]
Some rental platforms encourage hopeful tenants to share ‘excessive’ amount of information, Consumer Policy Research Centre review finds [...]
Abigail Bradshaw says ‘enormous’ amounts of money required to update systems that people now expect to be constantly available [...]
Exclusive: The Australian Criminal Intelligence Commission, which has access to NDIA data, used Palantir as part of a multi-agency fraud taskforce [...]
More than one million Quest apartment hotel guests have had their personal data stolen by hackers in a major data breach. The compromised information includes names and contact details from [...]
The Prime Minister is travelling to the United States, where he'll meet with world leaders to discuss online safety and artificial intelligence. After stark warnings from industry heavyweights this week [...]
The Director-General of the Australian Signals Directorate says Australia needs an AI 'early warning system' to defend against the dangers of the emergent technology. Abigail Bradshaw also struck a more [...]
September is MFA Month, making it the perfect time to review one of the simplest and most effective cyber security measures available: multi-factor … [...]
Cairns bailiff takes on new role after admission sitting Shayne Vigorelli was one of six lawyers admitted to the Supreme Court of Queensland as a … [...]
Scam alert: Scammers are impersonating ASIC via SMS. Scammers are sending SMS messages impersonating ASIC and urging recipients to call a fake phone … [...]
Key points A hardware failure at an Optus exchange in Victoria caused a voice outage lasting about one hour and 16 minutes on Friday. • The outage … [...]
NSW’s Premier has announced a raft of measures to combat the facilitation of serious crimes, such as gang-related murder. • Mon, 07 Sep 2026 • … [...]
Victorian car dealership says it is contacting its customers after their contact and vehicle details were compromised by hackers. • Mon, 14 Sep 2026 • … [...]
A Gold Coast man who worked with the Australian Taxation Office (ATO) has been charged over the alleged disclosure of information to organised crime … [...]
The COSBOA CEO says lessons learnt from the program “will help shape what comes next” as she celebrates assisting 23,150 small businesses. • Fri, 11 … [...]
Furniture giant Nick Scali has confirmed New Zealand customers’ personal details were held on systems affected by a security breach last month. In an … [...]
Australian Cyber Incidents and Audits Reports
September 2026 so far
Claim 16-Sep-26 AU NSW
[Unconfirmed] Thorndale Foundation has been listed by the ransomware group Qilin as a victim of their attack.
Thorndale Foundation is a disability support services organisation operating in Western Sydney and has been listed by threat actor Qilin as a victim. The attackers posted sample images of passports, staff and contractor clearances, and other documents as proof of the claim.
Claim 16-Sep-26 AU VIC
[Unconfirmed] Threat actor Qilin has posted a breach claim against an Australian independent supermarket chain.
The Reddrop Group, a prominent Victorian independent supermarket, has been listed as a victim of a cyberattack by the Qilin ransomware group. Qilin provided no published evidence to support the claim.
Claim 16-Sep-26 AU NSW
[Unconfirmed] Leisure Coast Kitchens listed as a victim of Kairos ransomware group.
New South Wales' Leisure Coast Kitchens has been named by the Kairos ransomware group on a leak site. As of 17 September 2026, no public confirmation from the company, regulators, or mainstream media has been identified, so the claim remains unverified.
Claim 15-Sep-26 AU NSW
[Unconfirmed] TheGentlemen Ransomware Attack on Alchin Long Group
On September 15, 2026, the ransomware group The Gentlemen publicly claimed responsibility for a cyberattack against Alchin Long Group, a prominent Australian hardware conglomerate. The group posted an extortion notice threatening to leak sensitive data unless negotiations were initiated.
Confirmed 15-Sep-26 AU VIC
Exclusive: Aussie software firm Auto-IT confirms customers compromised by Storm ransomware attack
Maker of dealer management software responds to dark web hacking claims, saying a “small number of Auto-IT customer environments” were impacted by an unauthorised external party. On 18 August, the threat actor Storm, started listing Australian car dealerships and auto and machinery suppliers. Among the first were Westco Motors Cairns, alongside Ramsey Bros and Penfold Motors. The Sharp Motor Group, Agrimac, and Macquarrie followed.
Confirmed 15-Sep-26 AU WA
Student photos, bank details stolen by hackers after St James Anglican School in Perth hit by cyber attack
St James Anglican School, in Perth’s north, identified a cyber breach involving unauthorised access into its computer systems. Hackers copied names, addresses, emails, phone numbers, bank account details, student medical records and photographs of current and former students enrolled at the school since 2015, according to The West Australian.
Claim 14-Sep-26 AU NSW
[Unconfirmed] Dome Gold Mines listed by The Gentlemen Ransomware Group
Dome Gold Mines was listed on The Gentlemen's leak site. The Gentlemen claims it stole internal data. This is the group's claim, not a confirmed finding.
Confirmed 14-Sep-26 AU VIC
Exclusive: Penfold Motors latest car dealer to fall victim to the Storm ransomware group
Victorian car dealership Penfold Motors says it is contacting customers after hackers compromised their contact and vehicle details. Data published so far includes staff efficiency reports, customer details, vehicle identification numbers, and tax invoices.
Confirmed 10-Sep-26 AU NSW
Exclusive: Not-for-profit Way Forward suspends payments following external cyber incident
The New South Wales registered charity Way Forward has disclosed that its payment systems have been suspended following a third-party cyber incident.
Confirmed 09-Sep-26 AU VIC
Exclusive: The Gentlemen strikes Sharp Office as company confirms incident investigation
The ransomware group known as The Gentlemen has targeted Sharp Office, a Hunter Region office technology specialist, as its latest Australian victim.
Confirmed 08-Sep-26 AU NSW
Late patching of Metabase SQLi bug claims Sydney's Mathspace
Unknown attackers exploited a critical vulnerability in the Metabase business intelligence (BI) tool to breach the online mathematics learning platform Mathspace. Stolen data includes user IDs, usernames, first and last names, email addresses and other login-related information for students, staff, parents and guardians.
Published 08-Sep-26 AU VIC
Exclusive: Verve Portraits data allegedly compromised by Settra ransomware attack
Threat actor Settra has listed the Victorian-based photography business Verve Portraits, claiming that 105 GB of data was exfiltrated. Settra provided summaries of the information and files claimed.
Published 08-Sep-26 AU VIC
Exclusive: Machinery management specialist Macquarrie investigating data breach after ransomware claims
The Storm ransomware group continues to target Australian companies, this time adding the Victoria-based Macquarrie Corporation to its leak site last week. Sample images, including a passport, tax file declaration, invoice and other documents, were provided as evidence.
03-Sep-26 AU ACMA Telcommunication
ACMA fines Telstra for SIM swapping prevention misses
Telstra has been fined $277,000 by the Australian Communications and Media Authority (ACMA) for not using required identity authentication processes to prevent SIM swapping fraud. In addition to the penalty, the ACMA has accepted court-enforceable undertakings from Telstra to strengthen its fraud prevention processes and improve training for customer-facing staff.
01-Sep-26 AU NSW
NSW District Court, Privacy Act
A Canva account at centre of legal fight over employee privacy
Australia’s new privacy laws have been used to prevent a business, The Art Scene, from destroying a former employee’s personal information, including family medical records, that were stored on a Canva account, in an unusual early application of the new rules.
If you believe any information in this post is inaccurate or incomplete, please contact us so we can review the matter. Parties with additional relevant information relating to the incident are also invited to get in touch.
Australian InfoSec Incidents and Audits Issues
Incident: Insurer Prosura hit by cyber data breach, customers contacted by ‘threat actor’ | ABC Australia
Australian Insurer Ransomware Attack, 07 January 2026 Queensland-based rental car insurer Prosura...
Incident: Ascot Vale Health Group targeted by Global ransomware group | CyberDaily.au
Australian Medical Ransomware Attack, 06 Jun 2025: Victorian based Ascot Vale Health Group targeted by Global ransomware group. Global ransomware group has so far not listed how much data it has allegedly stolen or what kind of data may have been compromised.
Incident: RISE Racing confirms Sarcoma ransomware attack | CyberDaily.au
Australian Racing Industry Ransomware Attack, 05 Jun 2025: Victorian based RISE Racing confirms Sarcoma ransomware attack. Reports indicate that 1.6GB of sensitive data was stolen, including: Banking details, financial records, participant personal information and operational data related to the racing industry.
Incident: MKA Accountants confirms Qilin ransomware attack | CyberDaily.au
Australian Accounting Firm Ransomware Attack, 16 May 2025: Victorian MKA Accountants confirms Qilin ransomware attack. Qilin published 12 documents as part of its leak post, including internal correspondence, financial statements, and insurance information
Incident: NSW court website involved in major data breach, 9,000 documents downloaded | ABC News (Australia)
Australian Cyber Incident – Court Data Breach, 26 March 2025: NSW court website involved in major data breach, 9,000 documents downloaded. Man charged in connection with court document data breach.
Incident: Brydens Lawyers suffers alleged 600GB data breach following ransomware attack | cyberdaily.au
Incident – Law Firm Ransomware Attack, 13 March 2025: Prominent Sydney law firm Brydens Lawyers reveals a serious cyber incident in the wake of a February intrusion into its network. More than 600 gigabytes of data – including case, client, and staff data – was stolen in the incident.
NZ Incident: Kiwi car dealership Tristram European listed by DragonForce ransomware | Cyberdaily.au
NZ Incident – Ransomware Attack, 28 February 2025: DragonForce Ransomware Targets Kiwi Car Dealership Tristram European. The attackers claim to have stolen over 30 gigabytes of sensitive data, including customer information and financial records.
Incident: Australian IVF provider Genea in cyber incident | iTnews
Updated Incident – Medical Data Breach, 19 February 2025: Australian IVF provider Genea in cyber incident. Genea patients frustrated by lack of communication amid data breach.
Incident: Australian National University investigating alleged cyber attack | Cyberdaily.au
Incident – University Ransomware Attack, 16 February 2025: Australian National University investigating alleged cyber attack by FSociety ransomware group. No ransom amount was given; however, society is threatening to publish the data within seven days.
NZ Incident: KillSec claims breach of NZ medical supplier | Cyberdaily.au
NZ Incident – Medical Ransomware Attack, 13 February 2025: KillSec claims ransomware attack on New Zealand based Obex Medical. While the exact details of the breach remain unclear, this latest incident highlights the persistent threat of ransomware groups, particularly those focused on industries like healthcare.
Information Security Memes
Security quotes and wisdoms
- Quotes
Quote: Abraham Lincoln “You cannot escape the responsibility….”
“You cannot escape the responsibility of tomorrow by evading it today.” –...
