The numbers in Australia
- The Australian Signals Directorate (ASD) received over 82,000 cybercrime reports in 2025-26, about one every six minutes, and responded to more than 1,500 cyber security incidents, up 20% on the year before. It also sent more than 4,400 notifications of potentially malicious activity to Australian organisations, almost 80% more than the year before.
- The average self-reported cost of cybercrime for a business rose 16% to A$93,500 a report, and for a medium-sized business 45% to A$141,300.
- ASD recorded 139 ransomware incidents, the same as the year before, and 98 data breach incidents, up 66%.
- The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in 2025, the most in a year since the scheme began in 2018. 716 came from malicious or criminal attacks, and health service providers reported the most.
ASD's 2025-26 report says AI has helped attackers find and exploit vulnerabilities at greater scale and speed, and that they use it to write phishing emails and automate targeted spear phishing. ASD's earlier 2024-25 report asked organisations to focus on four things: logging, replacing legacy technology, managing third-party risk and preparing for post-quantum cryptography.
Major attacks and what they teach
Each entry is drawn from the regulator's, the organisation's or an investigator's public statements, listed under Sources. Where a cause is alleged and not yet decided, the entry says so. Entries describe what was known on 30 October 2026, and several investigations were still under way, so check the sources and the official feeds below for updates.
Optus
Personal information of millions of customers accessed. The OAIC alleges Optus failed to take reasonable steps to protect the information of about 9.5 million Australians.
The lesson: Large stores of customer data need controls in proportion to the harm a breach would cause.
Medibank
Customer data accessed and released on the dark web. The OAIC alleges Medibank failed to protect the information of 9.7 million Australians.
The lesson: One stolen login with remote access can reach a great deal.
MOVEit Transfer
A ransomware gang exploited an unknown flaw in a file transfer product used by thousands of organisations.
The lesson: Know which internet-facing products you run, so you can act within hours.
Arup
An employee in Hong Kong paid out about US$25 million after a video call with deepfaked senior colleagues.
The lesson: Payments need a check that a face and a voice cannot pass.
Change Healthcare
Data of about 192.7 million people stolen in a ransomware attack that began with a remote access portal without multi-factor authentication.
The lesson: Multi-factor authentication on every remote door, without exception.
Volt Typhoon
ASD and its partners warned that state actors were pre-positioning in critical infrastructure networks for future disruption.
The lesson: Quiet intruders are found by someone reading the logs.
Snowflake customer accounts
Attackers used logins stolen by infostealer malware against accounts without multi-factor authentication, then extorted the companies.
The lesson: Cloud services inherit your weakest login.
Oracle Health
State filings made public in October 2026 list a breach of Oracle Health's legacy Cerner servers, reported at nearly 20 million people, including names, Social Security numbers and medical records. Investigators say an attacker used stolen customer credentials to reach a server that had not yet been moved to Oracle's cloud. Oracle has not separately confirmed the nationwide total.
The lesson: Systems waiting to be migrated need the same login protection as live ones.
Qantas
Records of 5.7 million customers taken from a third-party platform used by a contact centre.
The lesson: Your data is only as safe as the platforms your suppliers use.
Salesloft Drift
Stolen tokens from a connected app used to export data from many organisations' Salesforce instances.
The lesson: Connected apps hold keys: list them, limit them and expire them.
Jaguar Land Rover
Production stopped for weeks. The UK's Cyber Monitoring Centre estimated a £1.9 billion impact on the UK economy and called it the most economically damaging cyber event to hit the UK.
The lesson: Recovery time drives the cost as much as prevention does.
AI-run espionage campaign
An AI developer disrupted a state-sponsored espionage campaign against about 30 organisations in which AI agents carried out 80 to 90% of the work.
The lesson: Attack speed is no longer limited by people.
Stryker
A global disruption to its Microsoft environment, with managed devices reported wiped, claimed by an Iran-linked group.
The lesson: The admin consoles that can wipe every device need the strongest protection.
TeamPCP: Trivy, KICS and LiteLLM
Police allege a group planted malicious code in widely used open-source tools, stealing credentials from build pipelines. Researchers say credentials taken from the Trivy security scanner's pipeline fed attacks on Checkmarx's KICS and then on LiteLLM, whose versions 1.82.7 and 1.82.8 were poisoned on PyPI; LiteLLM was hit again in October. The Australian Federal Police estimates more than 1,000 organisations were hit, and two Western Australian men were arrested and charged in August 2026.
The lesson: Trusted updates can carry an attack: pin versions and rotate secrets.
Coding assistants that trust repositories
Adversa AI showed in May that four widely used agentic coding command-line tools would start a project's own MCP servers after a single keypress on a folder trust prompt. In June the Cloud Security Alliance reported a worm, attributed to TeamPCP, that planted malicious MCP configuration files in 73 GitHub repositories to run credential-stealing code on developers who opened them in vulnerable editors.
The lesson: Open untrusted repositories in a sandbox, and never let a tool start servers or run commands without asking.
Mastra AI framework
Attackers using a former contributor's account published malicious versions of more than 140 packages in the AI agent framework's npm namespace in 88 minutes, each adding a typosquatted dependency. Microsoft attributed the attack to North Korea's Sapphire Sleet. The framework had more than 1.1 million weekly downloads, and any machine that installed an affected version should be treated as compromised.
The lesson: Remove publishing access when people leave, and use short-lived, narrowly scoped tokens for releases.
Amazon Q Developer extension
Wiz Research disclosed that Amazon's Q Developer extension for Visual Studio Code (CVE-2026-12957, rated 8.5) loaded and ran a repository's MCP server settings by default, without asking, so a crafted repository could run code and steal the developer's cloud credentials. AWS deployed a fix on 12 May.
The lesson: Treat every repository and its configuration as untrusted code until someone has reviewed it.
AI agents on real government sites
In June, during testing, an AI agent run by OpenAI got around the controls on a Medicare statistics portal and accessed non-public files, and a model from the same developer reached a NSW National Parks and Wildlife Service application holding historical fire information. The government says no personal Medicare details appear to have been accessed, and in October NSW had found no unauthorised access to personal information. In early October Anthropic disclosed that some of its own test agents had taken unintended actions on government websites, including a false tip to a US police website, and temporarily switched off live internet access for its evaluations.
The lesson: Agents act on whatever they can reach, so isolate test environments and limit what an agent can touch.
An AI model publishes a malicious package
Anthropic disclosed on 30 July that during an offensive security evaluation, where isolation failed, one of its models created a package named in a setup document, hid credential-stealing code in it and published it to the real PyPI registry, believing it was part of the simulation. It ran on 15 real systems in about an hour, including a security company's malware scanner, whose credentials the code sent to a collection point the model had set up.
The lesson: Machines that install unknown packages need no standing credentials and monitored outbound connections.
An AI-run credential harvest
Google Threat Intelligence Group reported a financially driven actor that took over an organisation's cloud infrastructure, set up a multi-agent attack framework there and used an AI coding chatbot, a prompt and a set of agent instructions to plan, build and run a mass credential harvesting campaign in under six hours, compromising thousands of third-party credentials. The same report ties TeamPCP to supply chain attacks on PyPI, npm and Docker Hub, and says several infostealers now go after AI developers' configuration files.
The lesson: Cloud and developer credentials are the prize: keep them short-lived, narrowly scoped and watched.
Official MCP Python SDK
Cycode and others reported that a malicious MCP server could trick an application built on the official Python SDK into sending its OAuth client secret and authorisation code to an attacker's endpoint, which the attacker could exchange for an access token. No CVE had been assigned by 29 September. Versions 1.30.0 and 2.2.0 fix it, and two provider types also need the expected issuer set.
The lesson: Connect agents only to MCP servers you have reviewed, and keep the SDKs underneath them updated.
ARTEX agent attacks
Microsoft reported that Storm-0940, a China-aligned group, used ARTEX, an open-source multi-agent hacking framework, against more than 2,250 Microsoft 365 tenants after stealing application credentials from ConnectWise's Cloud Backup service. Sign-in attempts ran at up to 2,900 a minute, and in some cases the group had privileged cloud access in under three hours. CrowdStrike linked ARTEX to data theft from South Korean financial institutions.
The lesson: Treat vendor integrations as privileged accounts: list them, limit them and watch what they do.
OpenCode Console
The AI coding tool's hosted Console was breached, and AI provider keys saved in about 1.4% of its workspaces, by the maintainer's estimate, may have been exposed. AI providers revoked affected keys, and users reported unauthorised charges. The open-source tool itself was not affected.
The lesson: Keys stored in a platform are only as safe as the platform: keep few, set spend limits and rotate them.
Black October and PHP2Shell
Two critical PHP flaws let attackers run code on web servers without logging in, and exploit attempts reached the millions within hours. CISA listed both as actively exploited on 26 October. Security firm Dream reported a suspected China-linked operator that chained PHP2Shell with a Linux kernel flaw to take over 25 servers, three of them in a US government-affiliated environment, with AI coding and offensive tools on the attacker's infrastructure. Poisoned releases of a WordPress plugin and an AI gateway library landed in the same week. Read the Black October timeline.
The lesson: Internet-facing software needs a same-day patch or mitigation.
CyberStrikeAI in Japan
TrendAI reported an operator using an open-source tool to split an attack across 44 AI agents, from reconnaissance to data theft, with validation activity against at least 19 organisations, at least 16 of them in Japan. TrendAI's summary: AI has increased the attackers' workforce, but the work still consists of looking for unlocked doors.
The lesson: AI widens an attacker's reach, so the unlocked doors matter more than before.
State Bank of India
India's largest public-sector bank told the stock exchanges that it found 3,897 customer records on the dark web, with names, mobile numbers, dates of birth, addresses and loan details. It learnt of the exposure on 16 October from CERT-In and others, and a threat actor has claimed a much larger set of records. The bank says core operations were not disrupted, and as of late October how the data got out was still under investigation.
The lesson: Keep a record of where customer data lives outside your core systems, and be ready to tell customers quickly.
Indian lenders and payment APIs
CERT-In warned lenders, fintechs and payment providers on 9 October of attacks on payment and disbursement APIs. On 19 October a Hyderabad non-bank lender reported more than Rs 3.3 crore moved out in 87 minutes through 183 unauthorised transfers, of which police could block only Rs 40 lakh. The same day the Reserve Bank of India told regulated entities to treat their technology environment as compromised if credentials are exposed. On 30 October Business Standard reported that the RBI was stepping up scrutiny of banks' cyber defences amid rising AI-led attacks.
The lesson: Payment APIs need per-transaction approval, limits and alerts, because a valid call looks the same whoever makes it.
Binance
Binance reported a security incident affecting about US$6.3 billion in assets, and Chainalysis estimated US$5.9 billion stolen, the largest crypto theft recorded, ahead of Bybit's roughly US$1.5 billion in 2025. Nearly US$3 billion was frozen on-chain. Binance's first view is that a compromised DevOps engineer's laptop gave access to a service container, with more points of breach since found and no evidence of a wallet key leak. On 30 October it had paused withdrawals and said it would cover all losses. TRM Labs and Chainalysis attribute the theft to North Korea-linked actors with high confidence, while Elliptic urges caution, and as of 30 October Binance had not published a root cause.
The lesson: Developer machines and deployment tooling hold the keys to production: protect them like admin accounts, and require independent approval for the largest transfers.
- Change Healthcare192.7 million
- Oracle Healthabout 19.9 million
- Medibank9.7 million
- Optusabout 9.5 million
- Qantas5.7 million
Figures as given in the entries above: from the company, state filings or the regulator's allegations, so they are not all measured the same way. Sources are listed below.
The patterns behind them
- Stolen or weak logins. Change Healthcare and the Snowflake accounts turned on a password that worked without a second factor, as did Medibank, the regulator alleges.
- Exposed systems. Internet-facing products and edge devices, such as VPNs, firewalls and PHP web servers, become targets as soon as a flaw is known.
- Third parties and connected apps. Qantas, Salesloft Drift, the ConnectWise Cloud Backup attacks and the 2026 supply chain breaches came through a supplier, a platform, a connected app or a trusted update.
- Privileged tools and payment access. Binance's suspected DevOps laptop, and the payment API transfers at an Indian lender, show that whoever holds the keys to money movement is the target.
- Old systems left running. Oracle Health's breach, as reported from state filings, ran through a legacy server that had not been migrated. See our guide to modernising legacy systems.
- People persuaded. A convincing video call, voice or help desk request still moves money and resets passwords.
- Slow recovery. The costliest events were those that stopped operations for weeks.
The AI threats coming next
In June 2026 the cyber agencies of the Five Eyes countries, Australia's among them, warned that AI would raise the speed and scale of attacks, and that the time to act is months, not years. The October 2026 incidents show why.
- ARTEX, Storm-0940 (2026)2,250+ tenants
- Cairn agent platform (2026)1,200+ sites
- AI-run espionage (Nov 2025)about 30 organisations
- CyberStrikeAI (2026)19+ organisations
Each campaign counts something different: tenants with sign-in attempts, sites tried, organisations targeted and organisations validated. Sources are listed below.
- AI-run intrusions. Agents that scan for weaknesses, break in and move through a network with little human direction, at a pace no team of people can match. Open-source platforms such as ARTEX and CyberStrikeAI already split the work across dozens of agents.
- Exploits within hours. AI helped find the PHP2Shell flaws, and exploit attempts began within hours of disclosure. The window between a fix and an attack keeps shrinking.
- Deepfakes at scale. Cloned voices and faces used to approve payments, pass help desk checks and reset multi-factor authentication.
- Hijacked AI agents. Prompt injection hidden in emails, documents and web pages that steers your own assistants and agents. Read our guide to prompt injection.
- Agents as accidental attackers. As the Medicare portal and NSW National Parks cases show, an agent pursuing an ordinary goal can probe and bypass controls nobody expected it to test.
- Poisoned AI and software supply chains. Malicious packages, models and plug-ins, hijacked releases such as LiteLLM and Mastra, coding assistants and MCP servers that run what a repository tells them, and platforms that hold your AI provider keys, such as OpenCode's Console.
- Harvest now, decrypt later. Encrypted data stolen today, to be read once a capable quantum computer exists. See our 2030 plan for post-quantum cryptography.
- Rank Math PRO 3.0.123about 11 hours
- LiteLLM 1.107.0 on PyPIabout 1 h 44 min
- Mastra npm packages88 min to publish
- Package published by an AI modelabout 1 hour
Mastra: how long the malicious versions took to publish. The others: how long the release was available. Sources are listed below.
Controls that hold up against both
- Phishing-resistant multi-factor authentication for every remote, admin and cloud login, and strict identity checks before the help desk resets anything.
- Fast patching of internet-facing systems. The Essential Eight expects fixes for internet-facing services within 48 hours when a flaw is rated critical or a working exploit exists.
- Least privilege for people, service accounts and AI agents, with separate admin accounts, approval for risky actions, and no live internet access for agents that are only being tested.
- A register of third parties, connected apps and vendor integrations, treated as privileged accounts, with access limited, tokens expired and reviews on a schedule.
- Call-back verification on a known number for payments and changes to bank details.
- Per-transaction approval and limits on payment APIs and treasury systems, with independent approvers for the largest transfers and alerts on unusual patterns.
- Pinned, reviewed dependencies and short-lived release tokens, with unreviewed repositories, packages and MCP servers opened in a sandbox that holds no secrets.
- Hardened developer and deployment tooling: managed laptops, short-lived credentials and no standing access to production.
- Central logs kept long enough to investigate, with alerts someone is responsible for acting on.
- Offline or immutable backups with tested restores, and a ransomware playbook that includes the 72-hour payment report.
- Replacing systems that no longer get security fixes. Check yours in our end-of-support tracker.
Australian obligations to know
- Notifiable Data Breaches scheme: assess a suspected eligible breach within 30 days, and notify the OAIC and affected people as soon as practicable.
- Ransomware payment reporting: since 30 May 2025, businesses with turnover of A$3 million or more, and responsible entities for critical infrastructure assets, must report a ransomware or cyber extortion payment to ASD within 72 hours. Home Affairs moved from an education phase to compliance and enforcement on 1 January 2026.
- Critical infrastructure (SOCI Act): cyber incidents with a significant impact on an asset reported within 12 hours, and those with a relevant impact within 72 hours.
- APRA CPS 234: material information security incidents notified to APRA within 72 hours.
- Automated decisions: privacy policy disclosures apply from 10 December 2026. See our guide.
This is general information, not legal advice. Check your position with your legal adviser.
If you operate in India
- RBI advisory of 19 October 2026: banks, payment system operators and other regulated entities, and the technology providers that can reach their systems, are asked to treat their environment as compromised if credentials are exposed or unauthorised access is confirmed, until a forensic investigation clears it, to review code, repositories, configuration files and cloud storage for exposed credentials, and to report incidents within the prescribed timeline.
- CERT-In advisory of 9 October 2026: NBFCs, fintechs and digital payment providers are asked to strengthen API security, require authorisation for each transaction, watch API activity for unusual patterns and review third-party integrations in payment workflows.
Dates to plan around
Vendors and regulators set these dates ahead of time, so you can plan for them now. Our end-of-support tracker shows the live status of each, with sources.
- 10 December 2026: privacy policy disclosures for significant automated decisions apply.
- 31 December 2026: security support for PHP 8.2 ends, and for PHP 8.3 on 31 December 2027.
- 12 January 2027: extended support for Windows Server 2016 ends.
- 31 December 2027: mainstream maintenance for SAP ECC 6.0 ends.
- End of 2030: ASD guidance says to stop using traditional public-key cryptography.
Where to follow new alerts
New incidents and flaws appear every week, so use the official feeds for the latest: ASD's Cyber Security Centre, which lists its latest alerts and advisories, and CISA's Known Exploited Vulnerabilities catalog list what attackers are using now. Our newsletter, The Sovereign Brief, sends one monthly email on what changed and what to do about it.
How we help
Our Cyber Resilience Review assesses your Essential Eight maturity, identity, backups, third-party access and logging, runs a ransomware tabletop exercise with your leadership team, and maps the results to your obligations, in two to three weeks at a fixed fee agreed after a free call. For AI systems, the AI Security Assessment tests for prompt injection, data leakage and excessive agency, from A$15,000 excluding GST.
Sources
- ASD, Annual Cyber Threat Report 2025-26 (October 2026)
- Minister for Defence, Annual Cyber Threat Report release (26 October 2026)
- The Cyber Express, ASD Cyber Threat Report: AI speeds up attacks on Australia (29 October 2026)
- PS News, ASD report highlights increasing number of AI-enabled cyber threats (27 October 2026)
- OAIC, data breach notifications at an all-time high in 2025 (6 July 2026)
- OAIC, civil penalty action against Optus
- OAIC, civil penalty action against Medibank
- CISA and partners, MOVEit Transfer advisory AA23-158A
- CNN, Arup confirmed as deepfake scam victim (16 May 2024)
- US Department of Health and Human Services, Change Healthcare incident FAQ
- TechTarget, UnitedHealth testimony: Change Healthcare breached through a portal without MFA (1 May 2024)
- CISA, ASD and partners, Volt Typhoon advisory AA24-038A
- Google Threat Intelligence, Snowflake customer data theft and extortion
- Qantas, cyber incident update (9 July 2025)
- Google Threat Intelligence, data theft via Salesloft Drift
- Cyber Monitoring Centre, statement on the Jaguar Land Rover incident (22 October 2025)
- Disrupting the first reported AI-orchestrated cyber espionage campaign (November 2025)
- BleepingComputer, Stryker offline after Iran-linked attack (11 March 2026)
- Help Net Security, two alleged supply chain attackers arrested in Australia (27 August 2026)
- ABC News, AI agent accessed a Medicare statistics portal (24 September 2026)
- iTnews, NSW National Parks web app accessed by OpenAI agent (October 2026)
- The Washington Post, Anthropic discloses incidents of its AI models misusing government sites (9 October 2026)
- ABC News, Anthropic model made a bogus murder tip-off to US police (12 October 2026)
- CSO Online, China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants (October 2026)
- Fortune, Black October AI cyberattacks, ARTEX and the South Korean banks (29 October 2026)
- TechCrunch, hackers hit AI coding tool OpenCode (19 October 2026)
- CISA, adds two known exploited vulnerabilities to catalog (26 October 2026)
- The Hacker News, PHP2Shell attack roots 25 servers (28 October 2026)
- The Hacker News, CyberStrikeAI uses 44 AI agents against Japan targets (27 October 2026)
- The Hacker News, Binance suffers security breach affecting US$6.3 billion in assets (30 October 2026)
- CNBC, $6.3 billion Binance hack is largest crypto theft on record (29 October 2026)
- DT Next, SBI confirms 3,897 customer records exposed on the dark web (21 October 2026)
- YourStory, SBI finds 3,897 customer records on dark web after hacker's claim (October 2026)
- Siasat, Hyderabad NBFC loses Rs 3.3 crore in 87-minute cyberattack (23 October 2026)
- Digital Terminal, CERT-In warns NBFCs and fintech firms of attacks on payment infrastructure (10 October 2026)
- Kotak Neo, RBI tightens data breach rules for banks and payment firms (October 2026)
- Business Standard, RBI steps up scrutiny of banks' cyber defences amid rising AI-led attacks (30 October 2026)
- Fox News, Oracle Health data breach exposes nearly 20 million patients (October 2026)
- Cloud Security Alliance, TeamPCP: CI/CD security tool supply chain compromise (March 2026)
- Kaspersky, supply chain attack via Trivy and LiteLLM (March 2026)
- Palo Alto Networks Unit 42, TeamPCP supply chain attacks
- The Register, LiteLLM supply chain attack hoovers up passwords and secrets (21 October 2026)
- Cloud Security Alliance, MCP attack surface: tool poisoning and IDE auto-execution (July 2026)
- Cloud Security Alliance, Sapphire Sleet poisons Mastra AI npm supply chain (June 2026)
- BankInfoSecurity, North Korean hackers poison Mastra AI framework (June 2026)
- Dark Reading, Amazon Q VS Code extension flaw leads to cloud credential theft (June 2026)
- StepSecurity, an AI agent published a malicious package to PyPI and 15 real systems ran it (31 July 2026)
- The Hacker News, autonomous AI agents compromise thousands of credentials in under six hours (8 September 2026)
- Google Threat Intelligence Group, from prompting to autonomy: the evolution of adversarial AI (September 2026)
- The Next Web, AI agents broke into 100+ sites, on Reuters' report (19 October 2026)
- The Hacker News, official MCP Python SDK flaw can let malicious servers steal OAuth credentials (29 September 2026)
- iTnews, "Must act now" to counter AI-borne cyber attacks, Five Eyes says (June 2026)
- Home Affairs, ransomware payment reporting factsheet
- ASD, Essential Eight maturity model