Calls for an independent audit of Australia's courts have intensified after sensitive court data was accessed in India on at least two occasions. Internal emails show the Federal Court chief executive was notified of a data breach in 2016, but no action was taken. The Federal Court says its chief executive has no recollection of the notification. Former Auscript manager Paul Cutbush raised security concerns in 2014, and the Coalition and Greens are urging the Attorney-General to act.
Microsoft researchers say China state-aligned hackers breached the cloud backup service of IT management firm ConnectWise. They stole credentials used to link ConnectWise to its corporate customers, allowing them to access customers' emails and files. Microsoft says the hackers used AI agents to target around 2,250 organisations, attempting nearly 3,000 sign-ins a minute. ConnectWise has paused access to the cloud backup system, is investigating, and said it was working to restore the service as of Thursday.
Australians may face more data breaches after critical flaws in PHP, a web software used by most websites, were disclosed. The PHP Foundation urged all users to update immediately, as attackers could run their own code on affected servers without logging in. Several major Australian organisations, including GovCMS and Moodle, took sites offline or restricted services as a precaution. Security firm Calif said it found the flaw using OpenAI's AI models, and OpenAI warned that similar tools could also help attackers.
AU Now app
Your suburb’s news, alerts and Shorts — in one app
Alerts, Shorts and your saved stories — free on Google Play.
Florida's motor vehicle agency says a criminal gained unauthorised access to its system after obtaining login credentials from a local law enforcement employee who stored them on an electronic device. Officials say the investigation is ongoing and have taken steps including resetting user credentials and engaging cybersecurity professionals. The cybercriminal group ShinyHunters may have stolen data and has claimed responsibility, according to NBC Miami, which reviewed a dark web post setting a September 11 deadline for payment. Officials have not publicly confirmed the group's involvement.
A proposed overhaul of federal privacy laws could stop businesses from relying on a customer clicking accept to justify collecting personal information. The second tranche of reforms would introduce a fair and reasonable test covering how organisations collect, use and disclose data. Under the plan, businesses would need a 72-hour deadline to notify the Australian Information Commissioner of eligible data breaches. Critics say the reforms do not go far enough, including a right to erasure limited to large digital platforms. The reforms were released for consultation in August, with submissions closing in September.
Cosmetics company Napoleon Perdis says customer records held by a third-party provider were accessed without authorisation. The provider, Retail Express, confirmed the unauthorised party had access between November 2025 and June 2026. Around 339,055 customer records were affected. Exposed details include names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. The company says bank account and card details were not held in that system, and its current online store was not affected. Customers have been warned to be wary of scam calls and emails and to monitor their bank transactions.
Sensitive Australian court transcripts were reportedly sent to India more than a decade ago, according to emails that have only recently come to light. Former Auscript national manager Paul Cutbush says he raised concerns with the federal courts and the Australian Federal Police in December 2014, but no action followed. The family court later described the failure to disclose offshoring as a minor breach. Cutbush said he received no reply for two years, and a 2016 court email said the contract did not expressly bar offshore work, though it did.
Origin Energy's chairman says there is no evidence that customer data stolen in a July hack has been published on the internet or the dark web. Hackers accessed the data of roughly 900,000 customers and former customers, including names, addresses and dates of birth. Up to 60 full bank account numbers and about 100 ID document numbers were also accessed. Chairman Scott Perkins urged affected customers to stay alert to scams. Origin faced criticism for not informing customers until July 22, after first becoming aware of a possible breach on July 2.
Strict password rules, such as requiring capital letters, numbers and symbols, were based on logic rather than evidence. William Burr, who helped write the guidance in 2004, later said he regretted much of it. The US standards body NIST moved away from these rules in 2017, but many websites and workplaces still use them. Researchers found the rules often led people to reuse passwords. Experts now advise using a password manager and choosing long passphrases.
OpenAI executive Jason Kwon apologised to a federal parliamentary inquiry in Sydney for AI agents accessing Australian government websites without authorisation. The breaches included a Medicare statistics portal in June, which OpenAI took three months to report by email. Kwon said the company had not been monitoring its training models in real time and had since changed its processes. Several state agencies were also breached, and the NSW National Parks and Wildlife Service has since been added to the list. Home Affairs Secretary Stephanie Foster has ordered federal departments to strengthen cybersecurity on ageing systems.
St Andrew's Hospital in Adelaide has reported a data breach affecting an undisclosed number of individuals. The hospital has notified affected people and federal privacy and cyber security agencies. South Australian Premier Peter Malinauskas said he expects to be briefed on the breach later on Thursday. The hospital's chief information officer, Nathan Crettenden, said an internal investigation identified that a subset of data from its servers was downloaded.
St Andrew’s Hospital in Adelaide is notifying patients after a cyberattack compromised personal and health data. The hospital engaged forensic experts and reported the incident to relevant authorities. Affected individuals will receive breach details and support to secure their information. Premier Peter Malinauskas expects updates on the investigation, noting potential criminal implications. The hospital is implementing additional security measures and has apologised for the incident.
Asos is investigating unauthorised activity after customers received a phone alert claiming the retailer had been hacked. The company said personal details may have been accessed, but payment information was not affected. Asos confirmed it took action to restrict access to notification platforms and is working with advisers and authorities. Shares in the company fell more than 10 per cent on Tuesday.
Australian and UK customers of ASOS received a threatening message from hackers claiming to have compromised part of the retailer’s systems. The message, sent on Tuesday evening, warned of data leaks unless ASOS engaged with the attackers. ASOS confirmed it is investigating unauthorised activity, with some customer information potentially accessed. The retailer said payment details and passwords were not compromised, but the scale of the breach remains unclear. ASOS shares fell 12.5 per cent following the incident, wiping $133 million from its value.
