The threat keeping Australian CEOs up at night

Since Optus put cybercrime in the spotlight, others have come forward to report cyber breaches.

Woolworths subsidiary MyDeal.com.au was targeted in a string of cyberattacks across Australia last weekend. The Australian online retail marketplace said data was exposed when its customer relationship management system was accessed by a “compromised user credential”.

On Tuesday, online wine seller Vinomofo disclosed it had joined the victim list when it found a major data breach in which an intruder accessed customers’ personal information including names, dates of birth, addresses and contact details.

Neither hack was in the same league as Optus in terms of size or customer detail intimacy. And for hackers, infiltrating a large bank would be akin to hitting the jackpot.

McEwan says NAB and its New Zealand subsidiary, BNZ, are protecting customers with new technologies such as biometrics and a team of experts that monitor customer accounts 24/7 to detect unusual account activity. The other banks have similarly robust systems in place.

That said, it isn’t a matter of if, but when.

The chairman of Australia’s Prudential Regulator, Wayne Byers told a parliamentary committee hearing last week a cyberattack on one of Australia’s financial institutions “will happen” at some point in the future.

“Financial institutions, at least in a broader context, are quite advanced (in cybersecurity) but what we also know is that, at some point, some sort of event will happen. It doesn’t matter what sort of defences you’ve put in place,” he said.

There is no endpoint. Instead, hackers and companies are locked into an arms race with both sides continuously sharpening their tools.

Just as the banks, and other organisations, spend billions to fortify their defences the cybercriminals continue to evolve and improve the sophistication of their attacks.

“For every attack or threat we stop, cybercriminals or countries behind them will launch another one using new and different methods,” McEwan said.

In 2021, the reported figure of money lost to scams and cyber fraud in Australia was $1.8 billion. McEwan said considering an estimated one-third of victims do not report being scammed, the actual figure is likely to be much more than $2 billion and growing every year.

Underreporting by scammed customers is understandable given the humiliation of falling prey to thieves only one step more sophisticated than those posing as Nigerian princes. Of more concern is the reluctance of companies to admit their systems have been hacked.

A recent survey carried out by PwC suggests Australian executives fear reporting breaches of cybersecurity will be harmful to their business because it will negatively affect profitability and market share.

Such attitudes fly in the face of demands from governments and shareholders for greater transparency on security breaches. If McEwan is right about cyberattacks being the nightmare fuel for Australian businesses then CEOs will need to get used to coming clean when company defences are breached.

The Market Recap newsletter is a wrap of the day’s trading. Get it each weekday afternoon.