Australia: documented file-borne breach events

Documented events

File-borne incidents in Australia

Most recent first. Every entry cites the public record it is drawn from.

1. 2026-04Phishing link in emailMedium impact

   GO2 Health: Phishing email opened a Brisbane clinic's main mailbox to an attacker

   The main reception mailbox at the Everton Park practice was accessed in April 2026. Because the mailbox auto archives, exposure was confined to twelve months of correspondence, which included some patients' Department of Veterans Affairs identification numbers, medical history and referrals; the primary patient records system was not reached. The regulator was notified in May and patients in July 2026, and no evidence of publication or misuse was reported.

   The documented vector. Phishing email that led to compromise of the practice's main mailbox. The practice's own statement says it became aware of unauthorised access to one of its email mailboxes via a phishing email, and engaged external experts to investigate and contain the incident. The statement does not specify what the message carried, and this entry does not fill that in.

   How this class of vector is removed

   The record names phishing as the route but not what the message carried. Inbound mail is processed before it reaches anyone rather than trusted on the strength of its sender, and a carried document is rebuilt to its format's known good specification, which is what this class of vector usually turns on and does not depend on the reader spotting anything. The record does not establish what arrived, so this is held at low confidence. The practice reported the compromise of a shared clinical mailbox, where mail reaching a busy reception desk is exactly the case processing on the mail path is meant to cover.

   Email CDR RelayContent Disarm and ReconstructionGlasswall Halo / Glasswall Meteor / Glasswall Genesis

   • healthcare

   Source: ABC News · Source: Cyber Daily

2. 2023-05-19Document downloadHigh impact

   FIIG Securities Limited: A zip archive holding a disguised script opened the breach behind Australia's first cyber penalty

   From 19 May 2023 the attacker used the downloaded script to fetch a second stage and establish persistence, reached a privileged account by 23 May, and exfiltrated about 385 gigabytes including driver's licences, passports, tax file numbers and bank details, with around 18,000 clients notified. The ALPHV group published data in June 2023. In February 2026 the Federal Court imposed a 2.5 million dollar penalty, the first Australian civil penalty for cybersecurity failures under financial services licence obligations.

   The documented vector. Zip archive containing a JavaScript file named to look like a security agreement. The corporate regulator's statement of claim records that an employee downloaded a zip file while browsing the internet, and that the archive contained a JavaScript file named "second ranking general security agreement 85822.js", which invoked the Windows script host. The archive and the disguised script are documented in the pleadings rather than in the judgment.

   Note on this entry

   The record is carried here for what the filename shows: a business-looking name on an archive is not evidence of a business-looking file, and the pleadings are unusually specific about it. No prevention analysis is published for this event.

   • banking

   Source: Australian Securities and Investments Commission · Source: Federal Court of Australia · Source: Australian Securities and Investments Commission

3. 2022-02-25Phishing link in emailHigh impact

   Australian Clinical Labs Limited (Medlab Pathology): Phishing email recorded as the vector behind Australia's first Privacy Act penalty

   The Quantum ransomware group compromised the Medlab Pathology network on or before 25 February 2022, exfiltrated 86 gigabytes and published it to the dark web by June 2022, exposing passport numbers, health information and payment card details for at least 223,269 individuals. In October 2025 the Federal Court imposed 5.8 million dollars in civil penalties, the first ever under the Privacy Act. The commissioner's filing also records that the company relied on its mail platform's built in malware detection and retained firewall logs for one hour.

   The documented vector. Phishing email addressed to an employee, per the Information Commissioner's court filing. The Australian Information Commissioner's concise statement records that the company's forensic provider concluded the attack vector was a phishing email addressed to an employee. The commissioner records that conclusion while criticising the adequacy of the engagement that produced it, and this entry carries the finding with that qualification attached rather than as a finding of the court.

   How this class of vector is removed

   The record names phishing as the route but not what the message carried. Inbound mail is processed before it reaches anyone rather than trusted on the strength of its sender, and a carried document is rebuilt to its format's known good specification, which is what this class of vector usually turns on and does not depend on the reader spotting anything. The record does not establish what arrived, so this is held at low confidence. The filing separately records that the organisation relied on its mail platform's built in malware detection, which is a different kind of control from rebuilding a file whether or not anything is recognised.

   Email CDR RelayContent Disarm and ReconstructionGlasswall Halo / Glasswall Meteor / Glasswall Genesis

   • healthcare

   Source: Office of the Australian Information Commissioner · Source: Office of the Australian Information Commissioner

4. 2019-08Phishing link in emailMedium impact

   RI Advice Group Pty Ltd: Court's agreed facts document email delivered ransomware and a credential capturing file behind a cloud link

   Nine cyber incidents across the licensee's authorised representative practices were put before the Federal Court, which in May 2022 made the first Australian finding that a financial services licensee had breached its licence obligations through cybersecurity failures. The agreed contributing failures included no filtering or quarantining of emails and absent or outdated antivirus. The licensee paid 750,000 dollars in costs and was ordered to engage a cybersecurity expert.

   The documented vector. Phishing emails linking to a cloud storage folder holding a credential capturing file; a separate incident in the same findings was ransomware delivered by email. The statement of agreed facts annexed to the Federal Court's 2022 judgment records that phishing emails were sent to over 150 clients asking recipients to click a link to a cloud storage folder, and that the folder contained a file that was capturing credentials. The same agreed facts record an earlier incident where a practice's reception computer was hit by ransomware delivered by email.

   How this class of vector is removed

   Two documented classes of vector sit here. Email delivered ransomware is addressed on the mail path, where inbound mail is processed and a carried document is rebuilt to its known good specification before delivery. The phishing campaign put a credential capturing file behind a cloud storage link, and a fetch that crosses an inspected path is treated like any other download, with a supported document rebuilt on the way through. The court's agreed facts note that no filtering or quarantining of email was in place, which is the control layer the first of these maps to.

   Email CDR RelayContent Disarm and ReconstructionICAP ClientGlasswall Halo / Glasswall Meteor / Glasswall Genesis

   • banking

   Source: Federal Court of Australia

5. 2018-11-09Email attachmentHigh impact

   The Australian National University: Campaign against university systems used malicious Word attachments to harvest credentials

   A sophisticated actor operated inside ANU's network for about six weeks from November 2018, targeting the domain holding human resources, financial and student administration records. ANU initially feared up to 19 years of personal records had been taken; later forensics indicated substantially less, though the exact records could not be determined. The university disclosed the breach in June 2019 and published a detailed public incident report in late 2019, which remains the authoritative account.

   The documented vector. Malicious Word documents that sent users' credentials to attacker infrastructure when opened. ANU's incident report documents that the initial infection was an interaction-less spear-phishing email, and that the attackers' second, third and fourth spear-phishing cycles then delivered malicious Word document attachments. In the report's words, the user opened the attached Word document and the credentials were sent to the remote server, with all attachments in those cycles using the same technique.

   How this class of vector is removed

   The documented file-borne stages of this campaign form one class of vector: malicious Word attachments carrying credential-harvesting code, are a supported document format and squarely what deterministic rebuild addresses: each attachment is reconstructed to the format's known good specification with macros and active content stripped, so the document that reaches the user cannot call out to attacker infrastructure. The Email CDR Relay applies that rebuild on inbound mail. The campaign's initial interaction-less email sits outside this class, which is why this entry maps the attachment cycles and not the whole intrusion.

   Content Disarm and ReconstructionEmail CDR RelayGlasswall Halo / Glasswall Meteor / Glasswall Genesis

   • education

   Source: The Australian National University · Source: ABC News

Elsewhere in the region

Other APAC territories