Privacy and Cybersecurity News This Week: What SMEs Need to Do Now

Privacy enforcement is becoming more practical, more coordinated and more expensive, while attackers continue to exploit the same basic weaknesses: excessive access, weak identity controls and poor visibility across suppliers.

For small and mid-sized organisations, the message from the past seven days is straightforward. Data protection is no longer a policy exercise that sits with legal or IT alone. It is an operational responsibility that affects customer trust, supplier management, insurance, incident response and business continuity.

1. Google faces a major EU privacy penalty over location data

Ireland’s Data Protection Commission has announced a fine of €403 million against Google following an inquiry into the company’s processing of location data. The regulator found concerns involving transparency, lawfulness and the way users were informed about features including Web & App Activity, Location History and Location Accuracy. Google was also ordered to bring its practices into compliance within six months.

The case relates to activity examined from 2018 to 2020, but its business implications are current. The decision shows that regulators can revisit long-running data practices and apply significant penalties where people may not have understood how their information was collected or used. It also reinforces that privacy risk is not limited to obvious sensitive data such as health or financial records. Location information, behavioural data and inferred preferences can also become the centre of enforcement action.

The case is particularly relevant to Australian businesses that use overseas cloud platforms, analytics tools, advertising technology or mobile applications. An organisation does not need to be a global technology company to face questions about whether its notices are clear, whether consent is meaningful and whether data use matches the purpose originally explained to customers.

A recent regulatory summary from the European Data Protection Board also shows that European authorities are working towards a more consistent approach to fines and corrective measures. That makes it harder for businesses to rely on uncertainty between jurisdictions as a compliance strategy.

Why it matters for businesses

• Privacy notices that are technically accurate but difficult to understand may not provide strong protection.
• Data collected for one purpose may create risk if it is later reused for profiling, advertising or automated decision-making.
• Businesses operating across borders may need to assess obligations under the Australian Privacy Act, the GDPR and other local privacy laws.
• Regulators may focus on the entire data journey, including collection, storage, sharing, retention and deletion.
• A compliance failure can create remediation costs and reputational damage even where there is no traditional cyberattack.

Practical steps to take

• Review customer-facing privacy notices for location, device, behavioural and inferred data.
• Map the personal information collected by websites, apps, customer portals and marketing platforms.
• Confirm that each major processing activity has a documented purpose and lawful basis.
• Remove analytics tags, SDKs and integrations that are no longer needed.
• Keep evidence of privacy reviews, approvals and changes so the business can demonstrate accountability.

2. New European guidance points to more consistent privacy enforcement

The European Data Protection Board adopted new guidance on the use of administrative fines alongside other corrective powers. The guidance is designed to make enforcement decisions more consistent and sets out a structured approach for deciding whether a fine should be imposed, whether it should be combined with another measure and how the response should be calibrated.

The guidance is not a new law that automatically applies to every Australian organisation. It is nevertheless an important signal about the direction of travel. Regulators are looking for repeatable evidence that organisations understand their data processing, assess risks and take corrective action promptly. A business that waits until an incident occurs before trying to reconstruct its data practices may find it difficult to demonstrate good governance.

For SMEs, the most important lesson is not to copy a large enterprise compliance program. It is to create a simple, usable record of what personal information the organisation holds, why it holds it, who can access it and what happens when something goes wrong.

The EDPB guidance is currently subject to consultation, as reported by European privacy authorities. Even before final wording is settled, the underlying expectations are familiar: accountability, proportionality, documented decisions and timely remediation.

Why it matters for businesses

• Privacy compliance is increasingly judged by the quality of decisions and evidence, not just the existence of a privacy policy.
• Corrective orders can be as disruptive as fines if they force rushed system changes, customer notifications or processing restrictions.
• Smaller businesses that rely on external providers still need to understand and oversee what those providers do with personal information.
• A documented risk assessment can reduce confusion when an incident or regulator enquiry occurs.
• Clear ownership matters. Privacy tasks should have named business and technical owners.

Practical steps to take

• Create a one-page data processing register covering customers, staff, suppliers and prospects.
• Record the reason for collecting each important category of personal information.
• Set retention periods and assign responsibility for deleting information that is no longer required.
• Review contracts with processors, marketing platforms, payroll providers and cloud applications.
• Run a short quarterly privacy governance meeting and record decisions, actions and owners.

3. The Miljödata breach shows why supplier security is your responsibility too

Sweden’s privacy regulator has fined IT systems provider Miljödata 1.8 million Swedish kronor after an intrusion that affected information relating to approximately 2.2 million people. Reporting indicates that the regulator found inadequate technical and organisational security measures and treated the matter as a serious breach of GDPR security obligations.

The incident is especially relevant to SMEs because many organisations outsource core data processing. Payroll, rostering, customer support, accounting, recruitment and document management are often handled by specialist providers. When a supplier suffers a breach, customers may still face notification duties, business disruption and difficult questions from affected individuals.

The lesson is not that every supplier must have the security budget of a major bank. The lesson is that procurement cannot end when a contract is signed. Businesses need a proportionate way to assess suppliers, verify important controls and respond quickly when a provider reports an incident.

The case was reported by security news coverage of the Swedish regulatory action. It also illustrates why organisations should ask not only whether a provider is compliant, but how the provider would detect, contain and explain a real incident.

Why it matters for businesses

• A supplier may hold more personal information than the customer organisation itself.
• A breach can spread across multiple customers when a shared platform or service is compromised.
• Generic assurances such as secure and industry standard are not enough for higher-risk processing.
• Delayed supplier notification can make regulatory reporting and customer communication harder.
• Poor supplier records create uncertainty about what data was exposed and who must act.

Practical steps to take

• Maintain an inventory of suppliers that store, access or transmit personal information.
• Classify suppliers according to the sensitivity and volume of data they handle.
• Request evidence of MFA, encryption, backups, access reviews, vulnerability management and incident response.
• Include clear breach notification timeframes and cooperation duties in contracts.
• Test one supplier incident scenario each year, including who contacts customers, regulators, insurers and legal advisers.

4. EvilTokens demonstrates that identity security is privacy security

Microsoft’s Digital Crimes Unit has disrupted EvilTokens, a phishing-as-a-service operation that used automation and AI capabilities to compromise email accounts and help criminals identify valuable targets. Microsoft linked the service to more than 12,000 compromised inboxes across over 10,000 organisations worldwide. The reported victims included organisations in Australia, the United States, Canada, the United Kingdom, India and France.

The operation reportedly helped criminals analyse compromised mailboxes, identify payment approvals and trusted relationships, and prepare convincing fraud attempts. The significance for business leaders is clear: an attacker does not need to steal a database directly to create a privacy incident. A compromised mailbox can expose customer information, contracts, payroll details, identity documents, legal correspondence and payment instructions.

This is also a reminder that MFA is not a single control with a simple yes or no answer. Attackers increasingly target session tokens, device authorisation flows, helpdesk processes and authentication enrolment. Stronger phishing-resistant methods are valuable, but they need to be supported by conditional access, monitoring and staff awareness.

The disruption was described in Microsoft’s Digital Crimes Unit announcement. The service has been disrupted, but the broader criminal techniques remain relevant and are likely to reappear in other forms.

Why it matters for businesses

• Business email compromise can become a privacy breach even when no central database is hacked.
• A stolen session or token may survive a password reset unless access is fully revoked.
• Finance, HR, executive and customer service accounts are attractive because they contain context as well as data.
• Small businesses are often targeted because payment processes and identity controls are less formalised.
• AI makes it easier for attackers to scale reconnaissance and tailor social engineering.

Practical steps to take

• Require phishing-resistant MFA for administrators, finance staff and other high-risk roles where possible.
• Disable device-code or similar authentication flows unless there is a documented business need.
• Review newly registered authentication methods, unusual sign-ins and impossible travel alerts.
• Train staff to verify unexpected payment, password and MFA requests through a trusted channel.
• Build a response checklist that includes session revocation, token invalidation, mailbox rule review and supplier notification.

5. The BigCommerce incident puts third-party applications under the microscope

Security reporting this week described a supply-chain incident involving the Ribon application, which was installed on a number of BigCommerce stores. Attackers used compromised third-party application credentials to access customer information, with reporting identifying names, email addresses, phone numbers and physical addresses among the data involved. The access reportedly occurred between September 13 and September 17, after which the credentials were revoked and the application removed from affected stores.

BigCommerce said the incident originated with the third-party application credentials rather than a direct compromise of the core BigCommerce platform. That distinction may matter technically, but it does not remove the practical risk for merchants. If a store has authorised an application to access customer records, the merchant still needs to understand what happened, whether customers are affected and what notifications may be required.

The incident was covered by SecurityWeek’s report on the BigCommerce and Ribon compromise. It is a useful reminder that modern businesses are built from connected services, not isolated systems. Every plugin, integration, API key and marketing tool can become a route to personal information.

Why it matters for businesses

• Third-party applications may have broad access that exceeds their business purpose.
• API keys and service credentials can be more valuable to attackers than user passwords.
• Removing an app after an incident may not answer whether data was already accessed or copied.
• Ecommerce, CRM and marketing integrations can expose large amounts of customer information quickly.
• Vendor approval should include security review, not just a check that the application is useful.

Practical steps to take

• List every application connected to ecommerce, accounting, CRM, email and file-sharing systems.
• Review the permissions granted to each application and remove unused integrations.
• Prefer short-lived credentials, scoped permissions and regular key rotation.
• Monitor API activity for unusual volumes, locations, download patterns and access times.
• Ensure your incident response plan includes third-party applications and cloud providers.

What This Means For Your Business

The news from the past week points to one connected reality. Privacy compliance, cybersecurity and supplier management are no longer separate workstreams. A privacy regulator may investigate how data was collected, a security team may investigate how an account was compromised, and customers may simply want to know whether their information is safe. Those are different questions about the same business process.

SMEs do not need a large compliance department to improve their position. Start with visibility. Know what personal information you collect, where it goes, which suppliers can access it and which people or applications have privileged access. Then focus investment on the controls that reduce the most realistic risks: MFA, access reviews, secure backups, supplier assurance, logging and tested incident response.

The most useful next step is a practical 30-day review. Check your privacy notices, remove unnecessary data and integrations, verify administrator accounts, confirm supplier contacts and rehearse a mailbox or cloud-account compromise. These actions are affordable, measurable and valuable whether or not a regulator ever asks to see them.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.