Privacy and Cybersecurity News Business Leaders Need to Know This Week

A breach at a major retailer, fresh warnings about automated attacks and a growing list of critical software updates all point to the same business reality: privacy and security risks are becoming operational risks.

For small and mid-sized organisations, the challenge is not trying to predict every attack. It is building practical habits that reduce exposure, limit the impact of an incident and demonstrate that the business took reasonable steps to protect personal information.

1. The ASOS incident shows how third-party platforms can become customer-facing attack channels

ASOS confirmed this week that attackers compromised a third-party communications platform and used it to send unauthorised notifications to customers. The incident is a useful reminder that a supplier does not need direct access to a core database to create a serious privacy and reputation problem.

A compromised marketing, messaging, customer support or cloud administration platform can be used to send convincing messages, redirect customers to scams or create confusion during an already difficult incident. For an SME, the immediate damage may include customer complaints, account takeover attempts, lost trust and a costly investigation into what the supplier could access.

The incident also highlights the difference between technical security and business continuity. Even if the main production environment remains intact, a trusted communications channel can still be abused to reach customers and employees at scale. Security teams should therefore treat external platforms as part of the organisation’s attack surface, not as separate services owned by someone else.

Practical steps for business leaders:

• Review every supplier that can send messages, reset passwords, access customer records or administer business systems.
• Confirm that supplier accounts use multi-factor authentication, preferably phishing-resistant authentication for administrators.
• Limit administrator permissions and remove accounts that are no longer required.
• Create a clear process for verifying unusual supplier activity, including unexpected notifications, password resets or changes to message templates.
• Prepare a customer communication plan that can be activated if a trusted channel is compromised.

A recent industry report on the ASOS incident provides further context on how a third-party platform was used to send rogue notifications. The lesson for smaller organisations is straightforward: vendor access needs the same level of governance as internal access.

2. Large breaches continue to expose the cost of weak access controls

Several high-profile incidents reported this week involved large volumes of personal information. A breach affecting Georgia Power and Alabama Power was reported to have reached around 400,000 accounts. Another incident involving Denmark’s central person register reportedly exposed information relating to millions of residents after attackers abused legitimate access to the system.

These cases are different in scale and context, but they share a common theme. Personal information is often lost not because an organisation has no security controls, but because access is too broad, monitoring is too weak or legitimate credentials are misused.

That is highly relevant to SMEs. Most small businesses do not operate national databases, but they still hold valuable combinations of names, addresses, identity documents, payment information, employee records and customer correspondence. A modest database can be valuable to criminals when it is accurate, current and linked to other information available online.

The risk becomes more complicated when a business relies on accountants, managed service providers, payroll platforms, software vendors or contractors. Each relationship may be reasonable in isolation, but the total number of people and systems with access can become difficult to track.

Practical steps for business leaders:

• Build a current register of systems that store personal information and identify who can access each one.
• Apply least privilege so staff, contractors and suppliers receive only the access needed for their role.
• Review privileged accounts at least quarterly, and immediately after staff departures or role changes.
• Turn on logging for sensitive systems and make sure someone reviews unusual access patterns.
• Separate customer, finance, HR and operational data where practical, so one compromised account cannot expose everything.

For Australian businesses, this is also a privacy governance issue. The OAIC’s regulatory approach emphasises preventing harm, supporting compliance and holding organisations accountable for poor data practices. Good access control is not only a security measure. It is evidence that the business understands where privacy harm could occur and has taken steps to reduce it.

3. AI is compressing the time available to detect and contain attacks

Microsoft’s latest Digital Defense Report, published this week, describes a security environment in which artificial intelligence is helping attackers automate parts of the attack chain. The report points to faster attack timelines, more accessible capabilities and the emergence of agentic systems that can perform tasks with less direct human involvement.

For smaller organisations, the practical implication is not that every business will face an autonomous cyberattack tomorrow. It is that traditional assumptions about slow, obvious attacks are becoming less reliable. Phishing, credential theft, reconnaissance and vulnerability exploitation can be combined and scaled more quickly than many small teams can investigate manually.

AI also creates privacy risks inside the business. Employees may paste customer information, confidential contracts, source code or internal correspondence into consumer AI tools without understanding where the information is stored or how it may be processed. Even where a provider offers strong security, the organisation still needs to decide what information employees are allowed to submit.

Australian organisations should pay close attention to transparency around automated decision-making. The OAIC has published updated information about privacy policy obligations that will apply from 10 December 2026 where computer programs make or substantially contribute to decisions that could significantly affect an individual’s rights or interests. The OAIC guidance on automated decision-making is especially relevant to businesses using AI for recruitment, credit assessment, insurance, customer eligibility, fraud detection or service decisions.

Practical steps for business leaders:

• Create a simple acceptable-use policy for generative AI, including clear rules for personal and confidential information.
• Record where AI is used in customer, employee or supplier decisions.
• Require human review for decisions that could materially affect a person’s access, employment, price, service or opportunity.
• Review privacy notices and contracts for AI tools, including data retention, training use, overseas processing and deletion options.
• Add AI-related scenarios to staff training, including fake invoices, impersonation and highly personalised phishing.

The aim is not to ban useful technology. It is to make sure productivity gains do not create an untracked data processing activity or a new route into the business.

4. Critical browser, mobile and business software patches need a faster response

Security reporting this week included a major Chrome update addressing 247 vulnerabilities, as well as Android updates covering 25 vulnerabilities, including a critical issue that could enable privilege escalation. Security researchers also reported a critical vulnerability affecting multiple Atlassian products, with unauthenticated attackers potentially able to access specific files in a web application root directory.

The exact products and versions affected will vary from business to business, but the broader message is consistent. Internet-facing software remains a high-value target, and attackers do not need to compromise an entire network to create a privacy incident. A browser, mobile device, collaboration platform, ticketing system or customer portal may provide the initial foothold.

SMEs often struggle with patching because technology is distributed across laptops, phones, cloud services, home offices and third-party platforms. It is common for a business to know that updates are important but lack a reliable list of devices and applications, or lack a process for prioritising urgent fixes.

Practical steps for business leaders:

• Maintain an asset register covering laptops, mobile devices, servers, cloud applications and internet-facing services.
• Enable automatic updates for browsers, operating systems and mobile devices wherever business applications allow it.
• Prioritise vulnerabilities that are actively exploited, internet-facing or associated with unauthenticated access.
• Ask managed service providers for evidence of patching, not just a general statement that updates are handled.
• Define a target time for emergency patches and report exceptions to a business owner.

The SecurityWeek coverage of this week’s patching activity illustrates how quickly the update landscape can change. Businesses do not need a large security team to improve their position, but they do need ownership, visibility and a repeatable process.

5. Privacy compliance is becoming more practical, visible and enforceable

The direction of travel for privacy regulation is clear. Regulators are paying closer attention to transparency, data minimisation, automated decision-making, third-party tracking and the way organisations respond when something goes wrong.

In Australia, the OAIC has continued to publish practical guidance for businesses, including updated material on privacy obligations connected with anti-money laundering and counter-terrorism financing reforms. Some professional service providers, including certain lawyers, conveyancers, accountants and trust and company service providers, were brought into the Privacy Act framework from 1 July 2026 under the expanded reforms. The OAIC guidance for AML and CTF reporting entities explains expectations around collection, protection and deletion of personal information.

Internationally, businesses serving European customers should also watch developments from the European Data Protection Board. Its work on transparency, web scraping, anonymisation and artificial intelligence shows that data protection questions are increasingly connected to product design and technology choices, not just legal wording.

For an SME, compliance does not have to mean producing a large library of policies that nobody reads. It means being able to answer basic questions clearly:

• What personal information do we collect?
• Why do we need it?
• Where is it stored?
• Who can access it?
• How long do we keep it?
• Which suppliers process it?
• What happens if it is lost or misused?
• How do we explain automated processing to customers and staff?

Practical steps for business leaders:

• Review the privacy policy against the way the business actually operates, rather than relying on a template.
• Create a simple data inventory for customer, employee, marketing and supplier information.
• Remove information that is no longer needed, especially identity documents and old exports.
• Check contracts with cloud providers and other processors for security, breach notification and deletion terms.
• Test the incident response plan with a short tabletop exercise involving management, IT, communications and legal advisers.

The compliance advantage is practical resilience. A business that knows what it holds and why it holds it can respond faster, explain its decisions more clearly and reduce the impact of an incident.

What This Means For Your Business

This week’s news is not a reason for smaller organisations to panic. It is a reason to stop treating privacy and cybersecurity as separate, occasional projects. A compromised supplier, stolen credential, unpatched browser or poorly governed AI tool can move quickly from a technical problem to a customer, financial and regulatory problem.

Start with the basics. Confirm that multi-factor authentication is enabled for email, cloud administration, finance and remote access. Check that backups are usable. Patch internet-facing systems. Review supplier access. Make sure employees know how to report suspicious messages and unusual account activity.

Then improve visibility. Keep a current list of systems and personal information, assign clear owners and review the list when the business introduces a new app, AI tool or outsourced service. If a system makes decisions about people, document how it works, what information it uses and how people can ask questions or seek review.

Good security is not about achieving perfect protection. It is about reducing avoidable exposure, detecting problems earlier and showing customers, staff and regulators that the business acted responsibly. For Australian organisations, that is becoming an important part of trust and competitiveness, not just a technical obligation.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.