Attackers get into a business email account and use it to redirect payments, steal data or impersonate staff.
Extortion
Ransomware encrypts your files and demands payment for their return. Even with payment, recovery is not guaranteed, and without proper backups it can mean permanent data loss.
People
Convincing emails trick staff into revealing passwords or clicking malicious links, and modern phishing is hard to tell from the real thing.
Passwords
Stolen usernames and passwords are traded online. Reused passwords or accounts without multi-factor sign-in let attackers walk straight in.
Data
Attackers create hidden forwarding rules or sync files to outside locations before anyone notices, so data may be copied out before the breach is found.
Suppliers
Attackers compromise a trusted vendor or partner to reach your systems. If your suppliers have weak security, their breach can become yours.
Since February 2018, businesses covered by the Privacy Act must tell affected people and the OAIC when a data breach is likely to cause serious harm. It covers businesses and not-for-profits with annual turnover of more than $3 million, private sector health service providers, businesses that trade in personal information, and some others.
The OAIC was notified of 1,113 data breaches in 2024, the most since the scheme began. From July to December 2024, 69% came from malicious or criminal attacks.
The Australian Signals Directorate’s Essential Eight are eight mitigation strategies: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups.
They are increasingly referenced by cyber insurers, industry bodies and government buyers, and many can be put in place with Microsoft 365 Business Premium.
The EU General Data Protection Regulation can apply to an Australian business of any size that has an establishment in the EU, offers goods or services in the EU, or monitors the behaviour of people in the EU. It shares many requirements with the Privacy Act, and adds rights such as the right to erasure.
The most serious breaches can attract fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher.
01
The most effective single control. Every account should have it, with no exceptions.
02
Anti-phishing policies, Safe Links, Safe Attachments and impersonation protection in Microsoft Defender for Office 365, configured properly.
03
Watch sign-in locations, forwarding rules and admin role changes, so you find out about a compromised account straight away.
04
Microsoft 365 retention is not a backup. Back up email, OneDrive, SharePoint and Teams to separate storage.
05
Every device that touches business data enrolled, encrypted and managed, with Microsoft Intune in Microsoft 365 Business Premium.
06
Review your Microsoft Secure Score, incident logs and settings each month, because threats and your business both change.
