The Essential Eight for small businesses, in plain English
What ASD’s eight cyber security strategies mean for a 10-person office, which maturity level to aim for, and a practical first step for each one.
Security
Privacy, cyber security, scams and practical ways to protect your digital life.
Account and device security, data privacy, active threats and official warnings, with clear explanations of who is affected and what to do. Scams are one part of the coverage.
Scammed or hacked? Start here.
Do these first, in this order. Our first-hour guide has the detail.
- Call your bank on its official number and ask it to check for suspicious payments. If money has gone, say so: it may be able to stop the transaction.
- Get live help. For an incident happening now, business.gov.au says to call 1300 CYBER1 (1300 292 371).
- Report it through ReportCyber, and scams to Scamwatch.
- Get free recovery support. Businesses with 19 or fewer staff can call IDCARE on 1800 595 170 on weekdays.
Start here
Your business email has been hacked: what to do in the first hour
Business email hacked? The first-hour steps for Australian small businesses: lock the attacker out, check rules, warn your bank and customers, report.
How to check a supplier invoice before you pay it
Warning signs of payment redirection scams, a five-step check before paying, a bank-details policy to copy, and what to do straight away if you’ve paid.
Showing 1–12 of 47 stories, newest first
Spot the scam: the tax refund text from the ‘ATO’ or ‘myGov’
A text says a tax refund is waiting and you just need to tap the link. Here are the warning signs the ATO and myGov list, how to check safely, and what to do if you clicked.
Buying and selling scams are six in 10 scam-loss reports to Scamwatch
Scams on buyers and sellers, from fake shops to fake ‘item sold’ messages, made up 58.7% of Scamwatch loss reports this year. Here’s what they look like.
A long password lets attackers into some Alpine Linux servers
A decade-old bug lets attackers log into some Alpine Linux and other musl-based systems over SSH without a password. Who’s affected, and how to check and fix it.
Hackers are defrosting supermarket freezers. Is yours online?
US agencies warn hackers are targeting commercial fridge and freezer controllers and could change temperatures. Australia’s cyber agency says check your exposure.
Apple will check anything you share by public iCloud link
From iOS 27.3, files and photos shared with ‘Anyone with the link’ are open to Apple’s harmful-content checks. What changes, and how to share privately instead.
Myth or fact: Incognito mode hides you online
Private browsing stops your own device keeping a record. It doesn’t hide you from websites, your employer or your internet provider. Here’s what it does do.
Seven Gmail and Google Account settings that help stop phishing
A fake invoice or login page only needs one click. Seven Gmail and Google Account settings that cut the risk, with Google’s own steps for each.
Google and partners shut a botnet hidden in 1.3 million Android TV boxes
Cheap Android TV boxes came with a backdoor built in. Up to 42,000 were in Australia. Google has cut the criminals off, but the code is still on the boxes.
PHP2Shell fixes are out for Synology and QNAP storage boxes
Your web host has probably patched PHP. The storage box in your office is your job. Synology and QNAP have released PHP2Shell fixes, including for older systems.
A tampered Claude Code extension left a back door on Cursor users’ computers
Two bad versions of the Claude Code extension on Cursor’s marketplace planted a hidden SSH key on Macs and Windows PCs. Uninstalling may not remove it.
Is paying for a password manager worth it?
Apple and Google include free password managers. What Bitwarden and 1Password charge, what the money adds, and who should pay, from the vendors’ own pages.
Cybercrime is reported once every six minutes in Australia
ASD’s new threat report counts 82,000 cybercrime reports and says AI is helping attackers move faster. Small businesses report an average cost of $55,400.