October was a busy month for cyber security in Australia. Two major government reports landed in the same week, several well-known businesses disclosed breaches, and the federal government’s own cyber security website was taken offline. Here is a round-up of what happened, and what local businesses can learn from it.
The Big Picture: ASD’s Annual Cyber Threat Report
On 26 October the Australian Signals Directorate (ASD) released its seventh Annual Cyber Threat Report, covering the 2025–26 financial year. The headline figures:
- More than 82,000 cybercrime reports — about one every six minutes.
- More than 1,500 incidents responded to by the Australian Cyber Security Centre, up more than 20%.
- More than 4,400 notifications sent to organisations about possible malicious activity on their networks, almost 80% more than the year before.
- An average self-reported cost of $93,500 per cybercrime report for businesses, and $33,000 for individuals.
The report’s main theme is artificial intelligence. Attackers are using AI to write convincing phishing emails, automate scams and exploit newly announced flaws faster. Home Affairs and Cyber Security Minister Tony Burke said being under attack is “certain, constant and ever present”, and urged organisations to report incidents to ASD sooner.
Data Breaches: Fewer Small Ones, More Big Ones
The same day, the Office of the Australian Information Commissioner (OAIC) released its Notifiable Data Breaches statistics for January to June 2026. It received 667 breach notifications, almost the same as the previous six months. The worrying number is the scale: breaches affecting more than one million people rose from 4 to 11.
Health service providers reported the most breaches (149), followed by education (85) and business and professional associations (79). Malicious or criminal attacks remain the leading cause, but human error is still close behind.
Privacy Commissioner Carly Kind’s message was simple: organisations can’t lose personal information they don’t hold. Collecting less and deleting what you no longer need is one of the cheapest security controls there is.
Incidents That Made the News
PHP2Shell takes government websites offline
On 21 October the ACSC issued a critical alert about two flaws in PHP, the language behind WordPress, Drupal and much of the web. That night, cyber.gov.au and other federal sites were taken offline while the risk was dealt with. Attacks began within a day. We explain what happened and what to check in PHP2Shell: The PHP Flaw That Took cyber.gov.au Offline.
OFX investigates access to client data
On 2 October, ASX-listed money transfer company OFX told the market it was investigating unauthorised access to data, including some client data. It said client accounts and funds had not been accessed. By mid-October it had confirmed that the databases behind its client platforms were not accessed and was contacting affected people directly.
Napoleon Perdis caught by a supplier breach
Cosmetics brand Napoleon Perdis told customers that a cyber attack on Retail Express, the outside provider that stored its customer records, exposed about 339,055 records. The attacker had access between November 2025 and June 2026. Reports say names, contact details, addresses and purchase history were involved. The company warned customers to watch for scam calls and emails pretending to be from the brand.
An $809,000 lesson for a Queensland department
Closer to home, the annual report of Queensland’s Department of Customer Services, Open Data and Small and Family Business revealed it lost $809,000 in a cyber attack in July 2025. A third-party SMS service used by the government was misused to send large volumes of unauthorised text messages. No government data was compromised, but the cost was real — and this is the department that leads Queensland’s cyber security strategy.
What Local Businesses Should Take From This
- Your suppliers are part of your security. Two of the incidents above came through third-party services. Know which outside providers hold your customer data or can send messages in your name, and ask them how they protect it.
- Watch your bills for unusual usage. The Queensland loss came from a messaging service being abused. Set spending limits and usage alerts on SMS, cloud and telecommunications accounts so misuse is caught in hours, not months.
- Patch quickly. PHP2Shell went from public to exploited in about a day. If you don’t know who updates your website, find out now.
- Collect less, keep less. Every old customer record you hold is a liability if you’re breached. Review what you collect and set a retention period.
- Report early. Reporting to ReportCyber (cyber.gov.au) or calling the ACSC on 1300 CYBER1 is free, and the earlier you call, the more they can help.
How Electriclatte Can Help
Whether it’s reviewing your suppliers, tightening up patching or working through the Essential Eight, our cybersecurity services are built for small and medium businesses in Far North Queensland and beyond. Get in touch for a no-obligation chat.
Sources
- Australian Signals Directorate, Annual Cyber Threat Report 2025–26, 26 October 2026.
- Cyber Daily, Aussie cyber agency received more than 82,000 cybercrime reports in 12 months, 27 October 2026.
- Office of the Australian Information Commissioner, Large-scale data breaches on the rise, latest OAIC statistics reveal, 26 October 2026.
- iTWire, PHP2Shell: the 14-year-old bugs that pulled cyber.gov.au and government sites worldwide offline, October 2026.
- OFX, OFX Cybersecurity Incident, updated 15 October 2026; Cyber Daily, ASX-listed fintech firm discloses cyber incident impacting client data, 7 October 2026.
- Your Life Choices, Napoleon Perdis data breach affects 340,000 of the cosmetics company’s clients, 2026.
- Information Age (ACS), Qld cybersecurity department loses $800k in cyberattack, 1 October 2026.
Photo by Gilberto Olimpio on Unsplash.