Australian Cyber Security News October 2026 | Breaches, AI, Privacy & Risk

 

This monthly review provides a curated summary of developments in information and cybersecurity, privacy, AI, fraud, governance, risk, and compliance in Australia. It includes notable security and privacy incidents, regulatory and legislative updates, audit findings, and other industry news relevant to business and government audiences.

This report may be used and shared within an organisation for internal awareness and educational purposes. Australian Cyber Aware retains the intellectual property rights to the compilation, selection, analysis, commentary, and presentation of the content. No part of this report may be reproduced, redistributed, republished, incorporated into a commercial product or service, or otherwise used for commercial gain without prior written permission.

This post may be updated as more news or reports are discovered. You can access the latest version on the Australian Cyber Aware website.

 

Commentary October 2026

October again showed how broad information and cyber risk has become. Australian organisations dealt with ransomware, data breaches, privacy incidents, third-party failures, emerging AI risks and increasingly sophisticated cyber threats.

I’ve also noticed a steady improvement in incident reporting, with a number of breach-reporting services emerging, including some AI-assisted services (thanks, Claude), and more technology-focused news sites making use of them. The result is that even smaller breaches are increasingly being identified and reported.

Healthcare, education, financial services, government and other sectors all featured during the month. At the same time, regulatory activity continued to reinforce that cybersecurity is not simply an IT problem. It is increasingly an issue of governance, risk management, accountability and organisational resilience.

Large-scale data breaches on the rise, latest OAIC statistics reveal | OAIC

New statistics from the Office of the Australian Information Commissioner (OAIC) reveal that incidents reported under the Notifiable Data Breach (NDB) scheme continue to rise, with a significant increase in the number of large-scale breaches affecting Australians in the first half of 2026.

MUST DO: Schedule yourself sometime and go to the Notifiable Data Breach statistics dashboard. The updated dashboard provides a publicly accessible resource for exploring trends in data breach notifications, including the causes of breaches, the sectors affected and the types of personal information compromised.

Fortnum Private Wealth penalised $1.35 million for cybersecurity failures

ASIC’s successful action against Fortnum Private Wealth. On 12 October, the Supreme Court of NSW approved a $1.35 million penalty, with Fortnum also ordered to pay ASIC’s fixed costs of $250,000, after Fortnum admitted failures relating to cybersecurity governance and risk management across its financial advice network.

The Fortnum Private Wealth case demonstrates that simply having cybersecurity policies and requiring people to complete assessments is not necessarily enough. ASIC’s case focused on whether adequate cybersecurity risk-management systems, resources, oversight and monitoring actually existed.

ASIC’s action against Fortnum Private Wealth was its third successful enforcement outcome involving cybersecurity failures by a financial services licensee, following RI Advice and FIIG Securities.

ABC wipes staff devices exposed to new, sophisticated cyber attack

On the scary new threat front, a new method of cyber-attack exploits known risks of online advertising. In some cases, simply viewing an ad could install spyware that would surveil what was being done on the computer.

Time to stop putting off installing adblockers on your fleets. Make it an early Christmas present to your security peoples.

 

Pick of the Month: Who is accountable when your data leaves the building

One of the most interesting stories of October was not really about hacking at all. The actual incident was reported back in Jun 2026 National security concerns over use of transcription company VIQ Solutions by 13 government agencies. Since then the background in how this was mishandled across multiple agencies has come to light

Reporting towards the end of the month revealed concerns that potentially sensitive Australian government information handled by transcription provider VIQ Solutions had been processed or made accessible offshore.

For businesses, the important lesson isn’t the particular organisation or supplier involved.

It is a much simpler question:

Do you actually know what happens to your information after you give it to a third party?

Almost every business relies heavily on third parties. Once information leaves your direct control, the risk doesn’t leave with it.

A contract doesn’t transfer the risk

Businesses understandably rely on contractual clauses requiring suppliers to protect information, comply with privacy requirements or keep data within Australia. Those provisions are important. But simply putting a requirement into a contract does not mean the requirement is being followed.

A service might be hosted in Australia but supported by personnel overseas. A provider may use offshore subcontractors. Backups may reside in another jurisdiction. Information might pass through another cloud service. Transcription, development or support activities might be outsourced again.

And increasingly there is another question:

Does your supplier use AI services to process your information?

What matters is not simply where the main server is located.

Businesses should understand:

• what information suppliers can access
• where it is stored and processed
• which countries it can be accessed from
• whether subcontractors are involved
• whether AI or other cloud services are used
• which security and privacy requirements apply
• how incidents must be reported
• how compliance is monitored; and
• who is accountable when something goes wrong.

The bigger issue is escalation and accountability

This is where I think the VIQ story becomes particularly useful for business. Suppose somebody in your organisation discovers that a supplier may be processing sensitive customer information somewhere it shouldn’t.

• What happens next?
• Who owns the issue?
• Does somebody assess what information could have been affected?
• Does Legal get involved? Privacy? Cybersecurity? Procurement? Senior management?
• Who challenges the supplier?
• Who determines whether other parts of the business may also be affected?
• Who decides whether processing should stop?
• Who tells customers or regulators if notification becomes necessary?
• And who checks that the problem has actually been fixed?

These questions should not have to be invented in the middle of an incident. For significant suppliers, businesses need defined escalation paths and accountable owners.

Practical actions for business

You don’t need a complex third-party risk program to improve your position. Start with four things:

GRC Calendar

• 📅 10 December 2026 Privacy Compliance Deadline – APP entities that use personal information in ADM with the potential to affect rights or interests will be required to provide information in their privacy policies about the kinds of personal information used and the kinds of decisions made using ADM. Find out more, New resources on transparency for use of AI and automated decision-making | OAIC

 

Looking Ahead

The broader direction is unlikely to change. Cyber incidents will continue, AI will create both new opportunities and new risks, privacy expectations will strengthen, and organisations will remain heavily dependent on cloud platforms, technology providers and other third parties.

For businesses, the priority should be less about trying to predict the next major cyber event and more about strengthening the fundamentals: understanding important information and systems, managing access, keeping technology current, assessing critical suppliers, preparing for incidents and making accountability clear.

From an Australian Cyber Aware perspective, we’re establishing relationships with several innovative Australian GRC solution providers, with the intention of bringing selected solutions into our service portfolio. The move to our new business structure is also progressing, and we expect to have our service catalogue online by the end of November.

“Be Safe, not too safe” – Steve…K.

 

 

---

Publicly Reported Incidents for October 2026

Claim Status: Confirmed = Acknowledged by organisation/public statement/regulator | Published = Published in mainstream or reputable media | Claim = Leak-site claim only, unverified | Withdrawn = The claim has been withdrawn | Denied = The victim has formally denied the claim | Unknown = No corroborating evidence has been found

NOTE: Claimed, withdrawn, denied, and unknown listings may be extortion events with no factual basis to believe that an actual incident occurred.

 

Confirmed 29-Oct-26 AU VIC
RMS Cloud, a major Australian accommodation software provider, confirms a cybersecurity incident
RMS Cloud suffered a data breach in late October 2026 in which hackers accessed guest names, contact details, and booking information, enabling highly convincing phishing scams across Australia; however, RMS states that no credit card or payment data was exposed.

Confirmed 28-Oct-26 AU NT
NT Health backtracks on claim only five patients impacted by RDH privacy breach
The Northern Territory Health Department has backtracked on its claim that only five patients were affected by a privacy breach that led to pregnant women’s confidential medical information being shared with 28,000 followers on Instagram by a “medical observer

Published 27-Oct-26 AU NSW
Qilin Ransomware Group Adds RaceTrakka to Its Growing Australian Victim List
Qilin listed an entity known as Race Trakka on October 26, alongside several spreadsheets and documents; however, while it was once a going concern, Race Trakka cancelled its ABN in 2019 and was deregistered by ASIC in 2023.
Commentary: Raises questions about closed businesses deleting/archiving defunct information/sites and whether previous directors can be held accountable.

Claim 26-Oct-26 AU VIC
[Unconfirmed] Warrnambool Bus Lines was claimed to be compromised in a ransomware attack attributed to Qilin in October 2026
Victorian bus company, Warrnambool Bus Lines has been listed on the Qilin breach blog. Sample images of vastions documents were provided including drivers licences and passports.

Confirmed 26-Oct-26 AU NSW
Fairfield City Council confirm an unauthorised access to their systems after threat actor, Qilin claimed the breach
The Fairfield City Council experienced a cyber incident in October 2025 involving unauthorized access to a portion of their IT environment. The council has been in contact with the Qilin ransomware group, which has claimed responsibility for the attack and has listed the council on its leak site. The council has reported the incident to relevant authorities and is working with cybersecurity experts to resolve the issue.

Claim 26-Oct-26 AU VIC
[Unconfirmed] EpicHealth Listed as Victim by TheGentlemen Ransomware Group
Australian healthcare provider EpicHealth Medical Clinic has been listed as a claimed victim by TheGentlemen ransomware group, with the incident reported as discovered on 27 October 2026. The available listing does not specify the volume or types of data allegedly accessed or stolen, and the scale of any potential leak remains unknown.

Claim 26-Oct-26 AU NSW
[Unconfirmed] Mann Group Listed as Victim by TheGentlemen Ransomware Group
Australian demolition and site-preparation company Mann Group has been listed as a claimed victim by TheGentlemen ransomware group. The available listing does not identify the types or volume of data allegedly accessed or stolen, and the size of any potential leak is currently unknown.

Confirmed 23-Oct-26 AU
ABC wipes staff devices exposed to new, sophisticated cyber attack
ABC Australia is wiping a small number of staff devices as a precaution but says it has found “no signs of compromise” from ads linked to a spyware campaign from an Israeli company.

Claim 23-Oct-26 AU QLD
[Unconfirmed] CDG Chartered Accounting has been claimed by Qilin as a ransomware victim.
Queensland-based CDG Accounting and Finance has been listed as a victim of threat actor Qilin. No supporting evidence was provided in the listing.

Claim 22-Oct-26 AU VIC
[Unconfirmed] Qilin group has listed Victorian-based company Creative Universe as a victim of a ransomware attack.
The threat actor Qilin group listed Victorian-based Creative Universe in October 2026. The organisation discovered the breach on October 22, 2026, and the Qilin ransomware leak site listed it. The breach reportedly involved stealing sensitive data, including passports and other confidential information. Sample images of various documents were shown in the listing.

Claim 22-Oct-26 AU NSW
[Unconfirmed] Qilin ransomware gang claims Bathurst RSL as victim
Bathurst RSL suffered a Qilin ransomware attack in late October 2026, with the breach recorded on 23 October 2026 and linked to criminal data theft that may have exposed member or operational information. Qilin provided sample images of various documents as evidence.

Claim 16-Oct-26 AU NSW
[Unconfirmed] Hackers claim to have stolen more than 200 million database records from Canva
The cybercriminal group The Seven Deadly Sins has claimed responsibility for an attack on Canva, the Australian design and visual communication platform, claiming to have stolen Salesforce records, enterprise licensing data, and commercial documents.

Claim 16-Oct-26 AU NSW
[Unconfirmed] Ransomware Group thegentlemen Hits: St Peters Anglican Primary School
The St Peters Anglican Primary School was listed in a claimed ransomware attack attributed to THEGENTLEMEN in October 2026. The attack involved the compromise of 18 employees, 8 users, and 25 third-party employee credentials, with an estimated 4,450 passwords and 10 cookies exposed.

Confirmed 16-Oct-26 AU QLD
Exclusive: Poole Group investigating LockBit ransomware attack
The Poole Group, an accounting and business advisory firm in Queensland, was listed by the LockBit ransomware group on October 10, 2026. “The Poole Group is responding to a cyber incident that affected part of its IT environment in recent days. Once detected, we immediately implemented containment measures and engaged external cyber security specialists to support our response and investigation,” the Poole Group said.
Original Notification: Claim 14-Oct-26 [Unconfirmed] Ransomware group lockbit5 hits Poole Group

Confirmed 14-Oct-26 AU WA
Exclusive: Mandurah SES confirms operations unaffected by ransomware attack
Mandurah SES has confirmed it is responding to the incident after being informed by state government authorities.
Original Notification: Claim 3-Oct-26: [Unconfirmed] Ransomware group thegentlemen hits Mandurah State Emergency Service. The Gentlemen claims to have exfiltrated data from the emergency services unit, which often includes sensitive personal information of volunteers, detailed operational response plans, inter-agency communication protocols, and records of collaboration with other emergency response agencies.

Claim 13-Oct-26 AU NSW
[Unconfirmed] Ransomware group N0n hits Hunter Neurology
New South Wales’s Hunter Neurology suffered a ransomware‑driven data breach on 13 October 2026, when the N0n ransomware group claimed to have stolen over 15,000 patient images/scans, 11,819 letters/reports, 439 lab results, 839 system files, and four full medical‑records backups, exposing extensive protected health information.

Confirmed 13-Oct-26 AU QLD
Exclusive: All Souls St Gabriels School investigating cyber incident in wake of ransomware claims
The ransomware group known as The Gentlemen has claimed another Australian victim, listing the Charters Towers-based All Souls St Gabriels School in a 9 October leak post.
Company Statement: Important Information About A Cyber Incident

Confirmed 12-Oct-26 AU QLD
Exclusive: Australian patient data compromised in Icon Cancer Centre hack
Icon Oncology Group confirms it is investigating the extent of the breach after data belonging to Australia’s largest cancer care provider was offered for sale on a hacking forum, with more than 31,000 documents allegedly compromised.
Company Statement: 12 Oct, 2026 Important notification – data breach incident 

Confirmed 08-Oct-26 AU
St Andrews Hospital Group of individuals impacted by data breach at SA hospital
An Adelaide private hospital, St Andrews Hospital, has notified individuals and cybersecurity authorities of a data breach of personal information. The precise number of people impacted, and the circumstances around the breach, are currently unknown.

Confirmed 07-Oct-26 AU VIC
Unpatched server behind Vic student AI data breach
An investigation published by the Office of the Victorian Information Commissioner (OVIC) found that an unpatched critical server vulnerability at a school caused a major Victorian Education data breach. Threat actors exploited the unpatched server to access and copy a database containing records of current and former students, prompting a statewide mass password reset.

Confirmed 07-Oct-26 AU NSW
ASX-listed fintech firm discloses cyber incident impacting client data
OFX Group Limited is an international money transfer and currency exchange business based in Sydney, Australia. In a statement published through the ASX, OFX Group disclosed the incident, saying it was currently investigating to understand the depth of the incident.
Company Statement: 2-Oct-26 Cybersecurity incident, 15-Oct-26 Update on cybersecurity incident 

Claim 04-Oct-26 AU NSW
[Unconfirmed] Chadwick Switchboards – qilin Ransomware Attack (Oct 2026)
Chadwick Switchboards was claimed in a ransomware listing attributed to qilin in October 2026. Qilin operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands

Confirmed 02-Oct-26 AU NSW
Rogue OpenAI agent enters another NSW government website, tech giant says
Reporting revealed that autonomous AI agents operated by OpenAI gained unauthorised access to internal file environments and web databases managed by the NSW National Parks and Wildlife Service. The automated bots accessed non-public administrative files and bushfire statistics while scraping data for AI model research. State authorities confirmed that no public safety systems or personal identity records were compromised during the access incident, and that security protocols were later updated to block unauthorised AI web crawler access.

 

 

---

Australian Regulatory Actions October 2026

14-Oct-26 AU NSW
ASIC, Supreme Court of NSW, Finance, Corporations Act 2001 (Cth)
Fortnum Private Wealth penalised $1.35 million for cybersecurity failures
The Supreme Court of NSW has ordered Fortnum Private Wealth Ltd to pay a $1.35 million penalty after admitting it failed to adequately manage cybersecurity risks across its financial advice network.
ASIC Chair Sarah Court said the outcome reinforced that AFSL holders must properly manage and protect against cybersecurity risk. ‘Today’s outcome is the third obtained by ASIC against a licensee over failures to adequately protect against cybersecurity risk, following previous enforcement actions against RI Advice and FIIG Securities.
‘In this case, Fortnum was aware of the cybersecurity risks facing its business and authorised representatives but failed to implement an adequate cybersecurity policy and have adequate oversight and monitoring arrangements.”

 

 

---

Australian Audit Reports October 2026

No audit reports were covered this month

 

 

---

Cyber News of Australia October 2026

Fri, 30 Oct 2026

VIDEO: ATO, ASIC failed to share concerns over offshore data risk | ABC NEWS
Internal emails have revealed the corporate watchdog failed to alert other government agencies about concerns that transcription service VIQ Solutions sent potentially sensitive work offshore. Sensitive data from courts and federal government agencies is prohibited from being stored or processed offshore due to potential hacking and national security risks.

Thu, 29 Oct 2026
Adelaide restaurant fights ‘negative review extortion scam’ through Google
An Adelaide restaurateur says she fended off an “extortion” attempt by an overseas company asking for money to remove fake negative reviews …

Thu, 29 Oct 2026
ATO, ASIC feared data breach by supplier VIQ Solutions a year before it was public
Australia’s corporate watchdog failed to alert other government agencies about concerns that transcription service VIQ Solutions had sent potentially …

Thu, 29 Oct 2026
In brief: cyberthreat detection and reporting in Australia
Threat detection and reporting Internal policies and procedures What policies or procedures must organisations have in place to protect data or …

Thu, 29 Oct 2026
From awareness to action: What APRA and ASIC now expect of banks, insurers and super funds adopting AI
AI in financial services often involves substantial amounts of personal information, and the Privacy Act’s new automated decision-making rules …

Thu, 29 Oct 2026
News website reporting on crime in Victoria staffed by workers in Philippines
The director of a website that reports news stories on Victorian crime has admitted its local team of reporters does not exist and that he uses …

Wed, 28 Oct 2026
RMS hack sees ‘convincing’ phishing scam emails using real hotel booking numbers sent to customers
The email looks real. “Thank you for booking Wrest Point Casino. We look forward to welcoming you,” it states. It then lists a reservation summary with …

Tue, 27 Oct 2026
ATO worker fired for allegedly accessing taxation information for stalking purposes

Tue, 27 Oct 2026

VIDEO: Cost of cyber attacks on medium-sized businesses spikes by 45 per cent
Deputy Prime Minister Richard Marles says the Australian Signals Directorate responded to “1500 cyber incidents” in the last financial year. “By historic standards that’s a big jump,” Mr Marles said during Question Time on Tuesday. “ASD is engaging with companies and organisations around the country in a much bigger way. Alerting them to threats, providing advice as to how to secure their IT systems. “For larger companies … the average cost of a cyber event has actually come down by 27 per cent. “For medium-size companies, that average cost has gone up by 45 per cent.”

Tue, 27 Oct 2026

VIDEO: ‘Prevalent and potent’ AI-powered cyberattacks threaten to disrupt everyday life | ABC NEWS
The Australian Signals Directorate says more disruptions to essential services are likely as AI increases the risk of cyber attacks. AI is turbocharging the number and potency of cyber threats Australia faces from criminal networks and state-aligned operators, the agency says. The ASD says cyberattacks were up 20% last year and expects that number to keep growing. ASD Director-General Abigail Bradshaw says ordinary Australians will have to get used to things ‘going offline’ to secure systems.

Tue, 27 Oct 2026

VIDEO: Intelligence agency warns of growing AI-powered cybersecurity threats | ABC NEWS
The Australian Signals Directorate has warned that more disruptions to essential services are likely as rapidly developing AI models increase the risk of cyber attacks. The intelligence agency has also revealed previously secret details of its offensive operations, including the targeting of criminals hoarding and selling personal data on the dark web.

Tue, 27 Oct 2026
AI just supercharged cybercrime. Australia is sounding the alarm
In brief Australia’s cyber agency warns AI is creating an unprecedented security threat. • State-backed hackers have used AI to target systems at greater …

Tue, 27 Oct 2026
Major holiday park operators warn guests about fraudulent emails, messages seeking credit card details
Australian travellers are being warned their personal information may have been exposed following a cybersecurity breach involving an accommodation …

Tue, 27 Oct 2026
Exclusive: Qilin ransomware group claims quartet of Aussie victims in as many days
The world’s most active cyber extortion group is continuing to target Australian businesses – including one that was deregistered years ago. …

Mon, 26 Oct 2026
Large-scale data breaches on the rise, latest OAIC statistics reveal
New statistics from the Office of the Australian Information Commissioner (OAIC) reveal that incidents reported under the Notifiable Data Breach …

Mon, 26 Oct 2026
Another win for ASIC on cybersecurity failures | Clayton Utz
Where did Fortnum fall short? Fortnum’s financial advice network comprised of over 80 advice practices and more than 200 authorised representatives. …

Mon, 26 Oct 2026
Exclusive: Bathurst RSL says cyber incident contained after Qilin ransomware attack
Hackers share passport scans and other personal data as club CEO says membership management systems unaffected. …

Mon, 26 Oct 2026
Stat dump: Data breaches impacting Aussies continue to rise, OAIC says
The Office of the Australian Information Commissioner has released data breach statistics for the first half of 2026, with more Australians impacted …

Mon, 26 Oct 2026
Parliamentary Information and Cyber Resilience upgrade has $40m budget
Key points The Parliamentary Information and Cyber Resilience project has a budget of $40 million over four years, Nicola Hinder revealed at senate …

Mon, 26 Oct 2026
OAIC annual report shows growing demand as Australians engage privacy and information access rights
Throughout 2025–26, the Office of the Australian Information Commissioner (OAIC) upheld and promoted information access and privacy rights, achieving …

Mon, 26 Oct 2026
Cyber security threats rise as AI menace gathers pace
Australia’s protection against and response to increasing cyber attacks has improved ahead of a major shift in security as frontier artificial …

Sun, 25 Oct 2026
Royal Darwin Hospital apologises over doctor’s posting of patient medical information to Instagram
Royal Darwin Hospital has issued an apology for a privacy breach that led to confidential medical information belonging to about a dozen pregnant …

Sun, 25 Oct 2026
Police officer charged, Brisbane Region – Queensland Police News
A 30-year-old male Constable from the Brisbane Region has been charged in relation to alleged computer hacking offences. The member has been charged …

Fri, 23 Oct 2026
Australia to strengthen neighbour’s cyber security under new Timor-Leste agreement
Australia will provide Timor-Leste with new maritime patrol vessels for the National Police and strengthen Timor-Leste’s cyber security and digital …

Fri, 23 Oct 2026
North Korean companies employing fraudulent online workers hit with fresh sanctions
The federal government has hit two North Korean companies and “shadow bankers” with sanctions for employing fraudulent online workers who help …

Fri, 23 Oct 2026
ABC wipes staff devices exposed to new, sophisticated cyber attack
The ABC has wiped staff devices that were exposed to a new, sophisticated cyber attack carried out as part of a broader campaign to track and even …

Fri, 23 Oct 2026

VIDEO: ABC wipes staff devices after sophisticated spyware campaign using online ads | ABC NEWS
The ABC has wiped staff devices exposed to a new cyberattack linked to a spyware campaign by an Israeli company. Researchers uncovered an operation using online ads to infect devices, targeting high-profile and sensitive Australian organisations.

Fri, 23 Oct 2026
Exclusive: Sydney-based visualisation firm Virtual Ideas hit by Lamashtu ransomware attack
Ransomware group Lamashtu claims Australian victim; hackers publish 35 gigabytes of data to the dark web. …

Fri, 23 Oct 2026
Exclusive: Campbelltown Anglican Schools Council investigating cyber incident following ransomware claims
The Gentlemen strikes again, this time listing St Peter’s Anglican School on its leak site; student data potentially compromised. …

Fri, 23 Oct 2026
AGL hits half-million milestone with passkey adoption
Key points AGL has reached 500,000 unique customer enrolments for passkeys since introducing them in December last year, lifting its overall adoption …

Thu, 22 Oct 2026
Attorney-general urged to step in as court data breach concerns grow
An integrity crisis in Australia’s court system has deepened, prompting calls from the Coalition and the Greens for the Attorney-General to step in …

Thu, 22 Oct 2026

VIDEO: Australian government sites taken down after discovery of PHP flaw | ABC NEWS
Some of the world’s biggest websites, including Australian government sites have been temporarily taken down after AI uncovered vulnerabilities in programming language PHP. About 75 per cent of the world’s websites use PHP and sites are being urged to implement a fix as soon as possible. Professor Lisa Given, the director of RMIT’s Centre for human AI information environments says there are examples of attacks happening by bad actors and the scale of the vulnerabilities has been ‘massive’ and ‘global.’

Thu, 22 Oct 2026

VIDEO: TPG accuses Aussie Broadband of being behind millions of scam calls to Vodafone | ABC NEWS
TPG has accused Aussie Broadband of not investigating and stopping bad actors. It comes as a new data from Vodafone found 98 per cent of the millions of scams calls on its network came from an internet phone company Symbio. Symbio is owned by Aussie Broadband. Aussie Broadband’s CEO says the company is committed to working with Vodafone’s owner TPG to solve the problem.

Wed, 21 Oct 2026
Vodafone’s owner accuses rival Aussie Broadband of being behind millions of scam calls to customers
Vodafone’s owner has accused its rival, Aussie Broadband, of being involved as a carrier in almost all of the scam calls made to its customers in a …

Wed, 21 Oct 2026
Australian government sites among those exposed to ‘critical’ PHP software flaw
Australia’s own cybersecurity agency was among the government websites affected by vulnerabilities in a widely-used internet programming language …

Wed, 21 Oct 2026
Raising the stakes: CIRMP governance, independent assurance and graduated civil penalties under the proposed tranche 2 SOCI reforms
What you need to know On 30 June 2026, the Department of Home Affairs released a consultation paper Streamlining and Modernising the Security of …

Wed, 21 Oct 2026
The Rental Privacy Shake-Up: What NSW’s New Laws Mean for Agents and Renters | Stanton & Stanton
Real estate agents, landlords and tenants in New South Wales should be aware of the recent passing of the Residential Tenancies Amendment (Protection …

Wed, 21 Oct 2026
SOCI Act and cyber security: Australian lessons from France’s connected device attack
…While cyber security practices have, for a period of time, focused on the security of personal information and other data, attacks on operational …

Tue, 20 Oct 2026
ClickFit: Business Email Compromise (BEC) | Australian Federal Police
Because one fake email can cause real financial loss.Cybercriminals often impersonate trusted businesses, suppliers, executives and colleagues to …

Tue, 20 Oct 2026
What next? Canva’s most recent third-party incident a ‘textbook case’ of supply chain risk
Canva may not have been directly hacked, but one of its tools definitely was – and that’s just as risky, says BlueVoyant’s managing director APAC, …

Tue, 20 Oct 2026
Report: Australian cyber executives threatened physically by hackers
Ransomware actors are increasingly turning to violent new tactics in pursuit of a payday, and staff and families are paying the price. …

Mon, 19 Oct 2026
Victorian councils crack down on smart glasses at pools and gyms over privacy concerns
A growing number of councils across Victoria are moving to ban smart glasses from public facilities, including swimming pools, childcare centres, …

Sun, 18 Oct 2026

Jobseekers scammed out of money, and worse in LinkedIn scams | ABC NEWS
Jobseekers are being warned of a rise in recruitment scammers on LinkedIn. The ACCC says it received 138 scam reports on LinkedIn in just two months. Professor Ryan Ko says scammers are making “unsolicited contact” towards users with ‘open to work’ logo on the site.

Sat, 17 Oct 2026
How Australian class action risk is shifting
Australia is a highly active class action forum, leaving businesses exposed to costly and burdensome litigation.

Fri, 16 Oct 2026
Cyber resilience: securing Australia’s energy transition
Watch: Cyber resilience and the energy transition Ross Phillipson explores the cyber security risks and opportunities arising from the energy …

Fri, 16 Oct 2026
Exclusive: Hunter Neurology investigating patient data breach claims
The n0n ransomware group says it has tens of thousands of patient records as healthcare provider Hunter Neurology investigates a possible third-party …

Fri, 16 Oct 2026
Exclusive: Poole Group investigating LockBit ransomware attack
An Aussie accounting firm is listed as a hacking victim; OAIC and the Australian Taxation Office have been informed of the incident. Daniel Croft and …

Fri, 16 Oct 2026
Australia’s peak cyber security body welcomes Essential Eight evolution
The ASD’s new Essentials framework is a step in the right direction, says the Australian Information Security Association. …

Fri, 16 Oct 2026
Exclusive: Aussie tech company with links to Defence, law enforcement allegedly breached by ransomware attack
Qilin ransomware group claims breach of Chadwick Switchboards; allegedly stolen data published on the dark web. …

Fri, 16 Oct 2026

VIDEO: Government budget data stored on vulnerable spreadsheets | 7NEWS
A former government software engineer claims Canberra’s mismanagement of our data is scandalous. Samuel Spencer tells 7NEWS that sensitive budget information is being stored on outdated software, leaving it vulnerable to criminals.

Fri, 16 Oct 2026

VIDEO: Deepfakes, hacked fridges and Australia’s evolving cyber defences
From banks battling big tech for AI talent to ransomware attacks exposing sensitive medical records, David Hollingworth and Daniel Croft unpack another eventful week in cyber security – including why your supermarket fridge might be a bigger security risk than you think. AI is reshaping everything from banking to elections, but are organisations keeping pace with the risks? Hollingworth and Croft explore the race for AI talent, the collapse of Firmus’ proposed $44 billion ASX listing, and growing concerns about AI-generated deepfakes in electoral advertising. With AI adoption racing ahead of governance, the pair examine the challenge of balancing innovation, economic opportunity and accountability. Then it’s on to the week’s cyber crime headlines, from French supermarkets hit by compromised refrigeration systems to ransomware groups claiming vast troves of sensitive healthcare data. The incidents affecting a pair of Aussie healthcare providers highlight the risks of third-party providers and compromised back-ups. Hollingworth and Croft also discuss why connected operational technology needs stronger security controls and why organisations must treat their suppliers as part of their own cyber perimeter. There’s good news, too. Australia’s new ASD Essentials framework marks an evolution of the Essential Eight, reflecting a threat landscape increasingly shaped by AI. And in a standout example of AI used for good, Indigenous rangers in Arnhem Land are using MegaDetector to streamline wildlife monitoring, cutting the images requiring analysis by 81.4 per cent. Tune in to Cyber Uncut for the latest developments, sharp analysis and a reminder that technology’s biggest risks and most promising applications can emerge from the same place. Enjoy, The Cyber Uncut team …

Fri, 16 Oct 2026
ASD’s Essential Eight replacement moves away from maturity ladder
Key points ASD is replacing the Essential Eight with ASD Essentials, a principles-based framework, though it will likely take a year or two to become …

Fri, 16 Oct 2026
ASIC’s security and data chiefs to leave in December
Key points ASIC’s CISO Jamie Norton and senior executive leader for data, analytics and AI Graham Jefferson have both resigned, with Norton staying …

Fri, 16 Oct 2026
Australian gov, media networks reached by Israeli firm’s spy ads
Key points Citizen Lab’s Exposing Adfection report says Israeli firm Discover-Tech used online ads to track devices and help plant spyware, reaching …

Thu, 15 Oct 2026
Companies that get hacked face stricter laws than firms unleashing rogue AI. We can fix that
The Australian government looks likely to introduce stronger legal checks on artificial intelligence (AI) companies to parliament early next year, …

Thu, 15 Oct 2026
Federal courts knew Australian data was sent to India more than a decade ago but took no action, emails reveal
Sensitive Australian court data was accessed in India more than a decade ago, newly surfaced emails have revealed, but the court took no action and …

Thu, 15 Oct 2026
Queensland government department loses $800,000 in cyber attack
The Queensland government department delivering the state’s first cyber security strategy lost more than $800,000 in a cyber attack, a new report has …

Mon, 05 Oct 2026
Data breaches and privacy complaints across Queensland’s public sector on the rise
The number of data breaches across Queensland’s public sector is increasing, including some deemed malicious and intentional, the state’s privacy …

Thu, 15 Oct 2026
‘Group of individuals’ impacted by data breach at SA hospital
An Adelaide private hospital has notified individuals and cyber security authorities of a data breach of personal information. In a limited statement, …

Thu, 15 Oct 2026
Veterans sue Australian government over sharing of medical data
A class action has been launched against the federal government over allegations of “mass and routine sharing” of veterans’ medical records over 20 …

Thu, 15 Oct 2026
Fake AUSTRAC officials, WhatsApp scams: Agencies targeted as AML/CTF enforcement ramps up
AUSTRAC has warned real estate agencies to stay vigilant as scammers impersonating the regulator have begun making their moves. …

Thu, 15 Oct 2026
AFCA closes consultation on proposed Scam Rules | Australian Financial Complaints Authority (AFCA)
The consultation on proposed changes to AFCA’s Rules has now closed. These changes will enable AFCA to consider scam-related complaints under the …

Thu, 15 Oct 2026
Exclusive: Mandurah SES confirms operations unaffected by ransomware attack
The Gentlemen claims hack of a Western Australian State Emergency Service unit; past and present members notified of the incident. …

Thu, 15 Oct 2026
The big melt: How Australia can stop a French-style refrigerator hacking campaign
Wherever there are refrigeration controls connected to the internet, there is risk, says Claroty’s Jason Pearce. …

Sun, 11 Oct 2026
Australian Cyber Security News September 2026 | Breaches, AI, Privacy & Risk
Australian Cyber Aware’s September 2026 review highlights major cybersecurity, privacy, AI, fraud, governance, risk and compliance developments …

Sun, 11 Oct 2026
ASD joins seven-nation alert as US seizes Chinese hacking firm’s tools
Key points US authorities seized seven domains supporting Integrity Technology Group’s MicroScan and FishHub hacking tools, as detailed in court …

Fri, 09 Oct 2026
Mobile networks finally get a disaster backup
Consumers can now expect better connectivity during disasters after Telstra, Optus and TPG Telecom implemented temporary disaster roaming (TDR) …

Fri, 09 Oct 2026
ASX-listed fintech firm discloses cyber incident impacting client data
An Australian ASX-listed fintech has disclosed a cyber incident which it says has impacted both client and other data. …

Tue, 06 Oct 2026
NSW National Parks web app accessed by OpenAI agent
Key points An OpenAI agent is under investigation after a “misalignment” incident on a National Parks and Wildlife Service web app in June. • Current …

Fri, 09 Oct 2026
CSIRO finds permanent CISO
Key points CSIRO has appointed Luke Forsyth, formerly a partner in the cyber domain at Deloitte, as its new permanent chief information security …

Fri, 09 Oct 2026
Unpatched server behind Vic student data breach
Key points A school’s delay in patching a critical server vulnerability, flagged by an Australian Signals Directorate alert on October 27 2025, led to …

Fri, 09 Oct 2026
NT government recovers from lengthy network outage
Key points A territory-wide outage knocked out access to telecommunications and digital systems across key NT government departments and agencies for …

Fri, 09 Oct 2026
Week in Review for 9th of October 2026
Online fashion retailer ASOS has confirmed that customer information may have been accessed following a cyber incident that saw hackers send …

Thu, 08 Oct 2026
Medibank facing dual court actions over data hack
Share article A hacker moved undetected through Medibank’s network for weeks despite multiple warning flags being raised, a court has been told. The …

Wed, 07 Oct 2026
Cyber security is changing. Are you keeping pace?
What the future of cyber security looks like and why cyber resilience needs to keep pace with business. Cyber security has become a speed problem, not …

Wed, 07 Oct 2026

VIDEO: OpenAI bots breach NSW government websites twice | 7NEWS
OpenAI has admitted its AI bots were responsible for a second breach of NSW government websites, accessing non-public historic wildfire data from the National Parks and Wildlife Services app in June.

Wed, 07 Oct 2026

VIDEO: Anthropic says AI agents didn’t breach Australian government websites
During a joint parliamentary hearing on artificial intelligence, Anthropic’s head of safeguards, Dave Orr, says that investigations of hundreds of millions of transcripts reveal no unauthorised interactions with Australian government systems. However, Orr acknowledges Anthropic has limited visibility into customer usage due to standard ‘zero data retention’ policies

Wed, 07 Oct 2026

VIDEO: Home affairs orders review over ‘unacceptable risk’ of AI
The federal government has ordered its departments and agencies to review their aging IT systems in a bid to combat the growing risks posed by artificial intelligence. The crackdown targeting outdated technology comes as calls for AI accountability rise across the globe.

Wed, 07 Oct 2026
Australian Information Commission launches smart glasses probe, Kmart product vanishes
Listings for controversial camera glasses have mysteriously vanished from the website of retail giant Kmart after a major probe was launched into …

Tue, 06 Oct 2026
ANZ releases advice on AI scams and fraud
Major bank ANZ has issued a warning regarding AI and increased levels of scams and fraud, highlighting that the technology is enabling threat actors …

Tue, 06 Oct 2026
Trusted government data can help counter AI misinformation, says OAIC
The Office of the Australian Information Commissioner has warned that proactive access to trusted government information is increasingly important as …

Tue, 06 Oct 2026
Report: Aussie government lags behind private sector in breach discovery
The average data breach in Australia takes three days to discover – but government breaches take more than 100. …

Tue, 06 Oct 2026
Australian government to invest $3.5m to combat technology-facilitated abuse
The Albanese government to stand up 12 new “innovative” projects as part of its National Plan to End Violence Against Women and Children. …

Tue, 06 Oct 2026
Op-Ed: The rogue agent breach of Medicare highlights the importance of AI literacy and fluency for lawyers
The newsfeed has reached a fever pitch about the dangers of artificial intelligence and “AI slop” in legal practice, with most of it focused on …

Mon, 05 Oct 2026
Jobseekers exploited by recruitment scammers on LinkedIn
Tony Young is one of many Australians who have applied for work using websites like LinkedIn, only to realise afterwards it was a scam. The former …

Mon, 05 Oct 2026
Small business delivers e-safety wishlist as risks grow
Small business owners need help – not regulation – to battle growing cyber threats, industry groups say. Business representatives addressed a …

Mon, 05 Oct 2026
Data breaches and privacy complaints across Queensland’s public sector on the rise
The number of data breaches across Queensland’s public sector is increasing, including some deemed malicious and intentional, the state’s privacy …

Sun, 04 Oct 2026
Week In Review for 2nd of October 2026
October is Cyber Security Awareness Month, and the Australian Cyber Security Centre (ACSC) is encouraging all Australians and organisations to take …

Fri, 02 Oct 2026
OpenAI reveals another hack into a government agency in Australia
The disclosure adds to a flurry of AI hacks recently revealed by the company. OpenAI on Friday revealed another hack into a second Australian …

Fri, 02 Oct 2026
Another NSW government website has been hacked by an OpenAI agent
In brief, the breach follows earlier break-ins to the NSW Bureau of Crime Statistics and Research and Medicare statistics. • In this breach, OpenAI’s …

Fri, 02 Oct 2026
Australia’s Medicare breach reveals a new kind of cyber threat. How must NZ respond?
Last week, New Zealand’s Privacy Commissioner ordered Manage My Health and Health NZ to make further security improvements following last December’s …

 

---

Australian Information and Cyber Security Videos 2026

 

---