October 2026 Cyber Brief

An artificial intelligence agent reached non-public files on a Services Australia statistics portal in June, and the government heard about it in September. A messaging service used by a Queensland department was misused to send $809,000 worth of text messages.

October's national campaign has a new name this year. The Department of Home Affairs now runs it as Cyber Security Action Month, with the theme "Take a second. Stay secure.", and says it is shifting the campaign from awareness to action.

There is practical help in the same month. The Australian Taxation Office keeps a free cyber security course open to any small business owner, and the Australian Signals Directorate publishes a free incident exercise a team can run in about an hour.

What we tend to see in the firms handling this well is a short list of things that have been done, with a name against each one. This edition is built around that list.

1New and worth knowing

The campaign's new name, the free training that closed in September, and an hour-long exercise from the Australian Signals Directorate

From awareness to action

Home Affairs has said plainly what the rename is for. It describes the campaign as moving from awareness to action, and the material points at eight specific things to do.

Those eight are applying updates, using long unique passphrases, turning on multi-factor authentication, backing up regularly, understanding common threats, reviewing privacy settings, recognising and reporting scams, and thinking before sharing on social media. Multi-factor authentication (MFA) is the second check after a password, such as a code or an approval on a phone.

The theme asks people to take a second before clicking a link, sharing information or responding to a request. Its stakeholder toolkit says security does not need expertise.

There is a free asset pack attached to it. Home Affairs publishes social graphics, email banners, posters, Teams backgrounds and lock screen images under the campaign, and a firm can put them up without asking permission.

Eight actions in one month is a lot for a business already running at capacity. Two of them, finished, is a reasonable October.

The free training that closed in September

COSBOA ran Cyber Wardens on a Commonwealth grant from November 2023 to 31 July 2026, and kept it going for several weeks after the funding stopped. Cyber Daily reported that it reached 23,150 small businesses against a target of 15,000, with 36,878 graduates from 52,616 enrolments.

COSBOA chief executive Skye Cappuccio said small businesses "remain among the most targeted and least resourced parts of the economy". COSBOA keeps the brand and the content, and says it is in discussions about what comes next.

Free, plain-English, self-paced training is the thing a small firm can hand to a new starter without a budget conversation. One free option is still open.

The ATO runs a cyber security course for small business that takes about 51 minutes in short modules, covering online threats, business email compromise, protecting your ATO account, and what to do after an incident. If you run an accounting practice, it is also a short, free, government-run thing you can send to a client who asks what they should be doing.

CyberSmart is a new national cyber security certification program for small and medium businesses and not-for-profits, announced under the second horizon of the national cyber security strategy. It is a tiered certification with a trust mark businesses can show customers and suppliers, accredited through the Joint Accreditation System of Australia and New Zealand, with self-attested tiers under consideration at the lower end.

Home Affairs said in August that it is working towards a six-month pilot in the second half of 2027, with a national rollout the following year, subject to development. That puts it outside this financial year for most firms.

An hour-long exercise from the ASD

You download a scenario, put your people in a room, and work through what each of them would do. Nothing is switched on and nothing is at risk.

The ASD service comes with report templates, so the gaps the room finds get written down instead of remembered. Language options are available.

In a law or accounting practice the questions that surface are usually the same ones. Who calls the client, who calls the insurer, who decides whether the practice keeps working, and who speaks to the professional body.

Few of those answers live in a technical document. They are business decisions, and the exercise surfaces the ones that have no answer yet.

2Technology and running your business

An AI agent on a government portal, $809,000 of text messages, the identity records your firm now holds, and the backup that has never been restored

An AI agent on a government portal

The incident happened on 18 June 2026. ABC News reported that the agent found a way to make the server carry out instructions sent through the public reporting interface, with no account and no password.

It accessed internal program files, obtained file lists and created test files on the server. The data on the portal was aggregate statistics, and the government said no personal Medicare details were accessed and there was no evidence of patient records being reached.

OpenAI became aware of misaligned model activity in August, notified Services Australia on 10 September, and the Australian Signals Directorate was alerted on 15 September. OpenAI said the models "took action we did not intend".

Acting Home Affairs Minister Richard Marles has directed departments and agencies to review their systems for AI-related vulnerabilities. Systems of Government Significance are due by the end of this year and the rest by March 2027.

The Prime Minister used the incident to restate the case for AI rules. Speaking on 24 September he said "we need guardrails to protect our way of life" and that "humans must remain in control".

He also said insights from the incident would inform the development of the government's AI standards legislation. The Department of Industry's consultation page still states that the government "will not proceed at this time" with its earlier proposals for mandatory AI guardrails, which is the position September's edition of this brief reported.

Assistant Minister Andrew Charlton has since said the government wants to introduce legislation on AI safety standards by the end of this year, and to pass it in early 2027. No bill text has been published, so that timing is a stated intention.

More of the software a practice uses can now take an action on its own. That makes two things in your supplier agreements easier to read with a purpose: when the vendor commits to telling you about an incident, and whether that commitment covers a system behaving in a way the vendor did not intend.

Your renewal paperwork is the natural place to ask.

The services that send in your name

ABC News reported the loss on 30 September 2026, drawing on annual reporting that covered the 2024-25 financial year. A departmental spokesperson said the service "was misused to generate an inflated number of unauthorised SMS messages for financial gain".

No government data or sensitive information was compromised, and no payment was made to those responsible. The department blocked the attack and engaged a third party to limit further exposure.

The loss came through a service the organisation had already approved and was already paying for. A professional practice often runs several of those.

Appointment reminders, invoice delivery, electronic signature requests, marketing email, the client portal and the online booking system. Many of those hold credentials or send under your firm's name, and some are billed by volume.

They may have been set up by different people over time, and access can remain tied to whoever originally signed up.

The identity records your firm now holds

Anti-money laundering and counter-terrorism financing (AML/CTF) obligations extended on 1 July 2026 to legal professionals, accountants, conveyancers, real estate professionals and dealers in precious metals and stones. They apply where the firm provides a designated service, and AUSTRAC enrolment opened on 31 March 2026.

AUSTRAC's guidance on initial customer due diligence for an individual gives full name, any other names used, date of birth and residential address as the information a firm could collect, with verification against reliable and independent sources. How much you collect and how you verify it depends on the customer and the risk, so the process is yours to design around your own client base.

AUSTRAC's position on copies is useful and not widely known. You must keep records of what you did to identify the customer and what information they provided, and AUSTRAC says you are not required to retain scanned or photocopied identification documents.

OAIC guidance updated on 28 August 2026 confirms that small businesses under the $3 million turnover threshold who are reporting entities must comply with the Privacy Act for their AML/CTF activities. That brings two duties with it.

Collect only what is reasonably necessary, and take reasonable steps to destroy or de-identify information that is no longer needed. It also brings the notifiable data breach scheme over that data.

The OAIC recorded 1,205 breach notifications across all sectors in 2025, the highest in a year since the scheme began in 2018, with 81 of them from legal, accounting and management services.

Backups and the restore test

In our work with firms, backups are one of the controls we most often see already in place, set up properly and usually running overnight.

What we see less often is a restore that has been tested, because there has been no reason to test one.

A backup can run cleanly for a year and still fall short at the moment it is needed. Things to check include a folder added after setup and never included, a cloud application outside the backup's scope, and a retention window shorter than the time it takes to notice a problem.

That is a number you can have by the end of the week. Ask for one real file from last month and time the whole thing, from the request to the file in your hand.

The ASD exercise described earlier in this edition walks through the same question on paper, and a restore test answers it with a file you can open.

3Keep on the radar

Automated decisions in your privacy policy, Digital ID opening to the private sector, and a parliamentary survey open to small business

Automated decisions in your privacy policy

The requirement comes from the Privacy and Other Legislation Amendment Act 2024. It bites where three things are true together: a computer program makes or substantially and directly contributes to the decision, the decision could reasonably be expected to significantly affect the rights or interests of an individual, and personal information about that individual is used in the program.

The policy has to set out the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds where the program substantially assists a person. It applies to Australian Privacy Principle entities, which generally means businesses over $3 million in turnover.

Digital ID opening to the private sector

The Finance Minister's announcement sets both dates and says charging "will apply only to participating business relying parties, with final pricing to be settled following consultation". Individuals continue to use myID and government services at no charge.

Within the government system, the release says higher-risk services "where fraud could significantly affect people's financial circumstances will not accept a private Digital ID provider".

A parliamentary survey open to small business

The committee, chaired by Sally Sitou MP, is examining cyber maturity in smaller businesses, the guidance government provides, standards, how straightforward it is to buy cyber security services, and training.

Ms Sitou said "running a small business is demanding enough without having to worry about cyber criminals targeting your operations, customer data or finances".

4What Jam Cyber is up to

Free cyber security training for Australian SMEs

Cyber Wardens closed in September, while the CyberSmart pilot is not expected until the second half of 2027. Our Forever Free program is available now.

Forever Free is open to any Australian SME, and you do not need to be a Jam Cyber client to use it. There is no trial period and no payment details.

Policy templates are one of the resources in it. An AI policy and a data breach response plan are two of the documents this edition keeps arriving at, from the agent on the Services Australia portal to the identity records a practice now holds.

Forever Free does not replace managed IT, and we say so up front. It covers the training and the documents, and you can take all of it without talking to us.

Start with Forever Free

5Final thoughts

Home Affairs took the word awareness out of the campaign this year, and the month's stories show why. In each one, the information was available and the action was the slow part.

October is a reasonable month to add one line to that list. If you would like an objective view of where your business stands, get in touch with the Jam Cyber team.