Notifiable Data Breach Laws

/

⚖️Legal Stuff Matters: If your business is raking in more than $3 million, congrats, but it also means the Privacy Act 1988 is something you've got to deal with. And for the smaller outfits, don't think you're flying under the radar. Certain activities, like dabbling in personal info or health services, mean you're on the hook too.

👤What Counts as Personal Info: Basically, anything from names to bank details. How you collect, stash, and eventually say goodbye to this info is pretty important, legally speaking.

🤦Data Breaches Aren't Just Oops Moments: Thanks to the Notifiable Data Breaches scheme, a slip-up that puts people at risk means you've got to fess up. It's more than just a bad look; it's a trust killer.

🧑‍💻Team Up with a Tech Partner: Flying solo through this legal maze? Not the best idea. A solid tech partner can break down the jargon, help you whip up a privacy policy that doesn't double as a snooze fest, and make sure you're playing by the rules.

✅Time for a Reality Check: How tight is your data security game? Is your team clued in on handling sensitive info? Regular check-ins here can save you a headache (or a heartache) down the line.

🕐Quick Takes:

  1. Stick to the Rules: Getting cosy with data privacy laws is a must, no matter your business size.

  2. Better Safe Than Sorry: Investing time and effort into data security now can prevent a world of pain later.

  3. Your Tech Partner is Your Ally: Finding a tech partner can translate legal gibberish into actionable steps.

  4. Build a Privacy-First Culture: Make privacy and data security part of your team's DNA, keeping your business on the right side of trust and compliance.

In the complex landscape of cybersecurity, there's a key factor that often gets overlooked: the human element.

/

It's a harsh but true fact that humans are frequently the weakest link in our security chains. Social engineering attacks, which leverage human psychology to deceive and manipulate, often result in unauthorised access to critical data and systems.

The most common types of these attacks include:

1️⃣ Phishing: Attackers masquerade as trusted entities and trick victims into opening malicious emails or messages.

2️⃣ Pretexting: Attackers fabricate scenarios to manipulate victims into divulging sensitive information or performing unlikely actions.

3️⃣ Baiting: Attackers offer enticing bait, digital or physical, to extract private data from unsuspecting victims.

Historically, Australian companies have fallen victim to these tactics, such as the 2017 ASIC scam, where phishing emails led to a widespread ransomware infection, and the "Catch of the Day" breach in 2011, where spear-phishing (targeted phishing) efforts resulted in significant data leaks.

To combat these threats, we need to focus on the human factor. Regular security awareness training for staff is crucial. It's essential for employees to understand these tactics, how to identify them, and how their actions can significantly impact the company's security posture.

Furthermore, an effective cybersecurity strategy needs to be driven from within. Businesses must take ownership of their cybersecurity, rather than outsourcing it entirely. While IT providers are important stakeholders, they should never solely own and be solely responsible for cybersecurity. This is a common misconception.

Instead, cybersecurity should be a shared responsibility, with all parts of an organisation contributing to a safer digital environment.

The key takeaway? Education and ownership are our greatest weapons in the fight against social engineering attacks.

How is your organisation empowering its staff to tackle these threats? Are you driving your cybersecurity strategy from within?
🔐💬👇

🔐💼💡 Federal Budget 2023: A glimpse into Australia's future of tech, cybersecurity, and privacy!

/

The recently unveiled Federal Budget 2023 brings notable highlights:
Digital Infrastructure: A $26.9 billion investment in enhancing Australia's digital infrastructure is set to streamline online service access, offering prospects for tech businesses.

Cybersecurity & Cyber Wardens Program: With escalating cyber threats, the budget prioritises cybersecurity, allocating resources to fortify cyber defences, including the Cyber Wardens program aimed at building a resilient cybersecurity workforce. Up to 50,000 cyber wardens will be trained over the next three years.

Quantum & AI Technologies: Recognising the transformative potential of quantum computing and AI, the budget sets aside substantial funds for these frontier technologies, showing commitment to innovation.

Tech Sector Wins: The budget caters to the tech sector with increased funding for R&D, innovation, and skills training - vital for industry growth and competitiveness.

Privacy and Digital Rights: As per Allens' insights, the budget emphasises privacy protections and digital rights, reinforcing the importance of a secure online environment for Australians.

Future Commitment: This budget reflects a commitment to a future where technology and cybersecurity are integral to Australia's socio-economic fabric, marking a step towards a resilient digital economy.

How will these changes influence your career or business?

Thoughts on the Cyber Wardens program and the focus on quantum and AI tech?

Are there areas you feel need more attention?

Fake MyGov profiles and unauthorised ATO access: The new cyber threat for Australian taxpayers

/

Cybercriminals targeting Australian taxpayers through fake MyGov profiles and unauthorised ATO account access have raised concerns.

Attackers create counterfeit MyGov profiles linked to victims' personal information, accessing ATO accounts to divert tax refunds and gather sensitive financial data. Weak security, such as reused passwords or weak multi-factor authentication, such as weak security questions or emailed security codes, if your email is also compromised, may contribute to breaches.

Case Study:

Sue, an Australian taxpayer, found unexpected changes to her bank details on her MyGov account. Cybercriminals accessed her ATO account via a fake MyGov profile, redirecting her $25,000 tax refund. Sue's case emphasises monitoring MyGov and ATO accounts for discrepancies and acting quickly when noticing suspicious activity.

Warning signs include unusual MyGov account activity, unexplained bank detail changes, unauthorised logins, or unfamiliar transactions. Regular monitoring and reporting suspicious activity are crucial. Victims of high-profile breaches (e.g., Medibank, Optus, Latitude) face higher risks and you can request a security block on your TFN.

Protection measures:

✅ Strengthen login credentials: Use strong, unique passwords for MyGov and email accounts. Ideally randomised ones via a password manager. Enable 2FA. An authenticator app is MyGov's most secure two/multi factor option.

✅ Beware of phishing emails: Avoid clicking links or downloading attachments from unverified sources; verify emails from ATO or MyGov.

✅ Monitor accounts: Regularly check MyGov and ATO accounts for suspicious activity. Have I Been Pwned site regularly to see if your email(s) has been involved in a data breach.

✅ Update devices: Install security patches and use reputable antivirus software.

✅ Report suspicious activity: Report compromised MyGov or ATO accounts to the ATO and Services Australia.

Being vigilant, securing personal information, and staying informed about cybersecurity threats is essential to defend against cybercriminals.

Latitude Financial Services Data Breach

/

You may have heard of the most recent data breach at Latitude Financial Services, in which the personal identification information of approximately 300,000 customers was stolen. We are not affiliated with Latitude Financial Services, but we wanted to make you aware of this incident as it may impact you if you are a Latitude Financial Services customer.

Latitude Financial provide financial services such as home and personal loans as well as credit card services for retailers such as Harvey Norman, JB Hifi, Good Guys etc. that offer interest free terms. 

According to reports, an unauthorised third party gained access to a portion of Latitude Financial Services' customer database on March 10, 2023. The stolen information may include your name, address, date of birth, contact information, and possibly other personal data.

We strongly advise that you take immediate steps to protect your personal information if you are or have been a Latitude Financial Services customer. 

This may include monitoring your financial statements and credit reports for any unauthorised activity, changing your password and enabling two-factor authentication for any accounts that use the same or similar passwords, and being cautious of any suspicious or unexpected communications or requests for personal information.

We encourage you to contact Latitude Financial Services directly for additional information and guidance on how to protect your personal information. We also recommend that you consider placing a fraud alert or security freeze on your credit report with the major credit bureaus.

We understand the importance of safeguarding personal information and we take data breaches seriously as we have seen the impact it has had on individuals and businesses over the years.

We are committed to supporting our customers that may have been impacted by this data breach during this difficult time and will continue to monitor the situation closely.

This is a great opportunity for you to do some “spring cleaning” and improve your password and Cybersecurity hygiene.

Firstly, get yourself a password manager, such as LastPass, so you can not only store all your passwords securely, you can use the manager to:

  • Check how secure your passwords are

  • Ensure you’re using unique passwords for every site or service you’re subscribed to

  • Check to see if your email address(es) or commonly used passwords have ever been involved in a known breach. You can also check this at Have I Been Pwned.


DON’T make up your own passwords.

Password managers create random, unique passwords, and let you set the complexity and length.

We recommend:

  • Upper and lowercase characters

  • Numbers

  • Symbols (not all sites allow this)

  • 20 characters (not all sites allow passwords this long)

  • Set a complex and easy to remember master password for your password manager.

  • We recommend a sentence with upper and lowercase, numbers and a symbol. E.g. ILoveParisInSpring2022! is a strong password.


For any sites or services, you’ve subscribed to that offer multifactor authentication for your online accounts, turning this on is a must. Only certain sites force multifactor authentication on you, such as financial accounting packages such as Xero and MYOB.

For any others, the best thing to do is to Google “How to turn on multifactor for %INSERT SERVICE HERE%” and you should be able to find an FAQ page for that service explaining how to enable it.

This is your first line of defence!

Now, not all multifactor authentication is created equal. Some are more secure than others. e.g. getting a code sent to your email or sending an SMS to your mobile is not recommended. This is worth a separate post. Watch this space!

However, some sort of MFA is better than nothing.

What Else Could You Do?

Credit Reporting

Put a temporary ban on your credit reporting - this will block anyone from applying for credit in your name. Extensions to the ban are possible under certain circumstances, especially if you suspect you’ve been the target of identity theft or Cybercrime. https://www.equifax.com.au/eform/submit/credit-ban

Banking

Make sure all your financial systems have multi-factor authentication. Surprisingly, and perhaps even shockingly, some banks and financial institutions don't force MFA on you, and some don't even offer it.

Contact your bank and notify them your data has been breached in the Optus breach and ask them to put a note on your file.

Further Information

Please visit cyber.gov.au or call them on 1300 CYBER1 hotline

Be alert for scams referencing the Latitude Financial Services data breach. Learn how to protect yourself from scams by visiting www.scamwatch.gov.au.

If you are concerned that your identity has been compromised or you have been a victim of a scam, contact your bank immediately and call IDCARE on 1800 595 160.

If your identity has been stolen, you can apply for a Commonwealth Victims' Certificate

The following websites can help you protect yourself and stay informed: