Cyber Security: An Afterthought Until There’s a Lawsuit

According to the Microsoft Digital Defense Report 2024, “customers face more than 600 million cybercriminal and nation-state attacks every day, ranging from ransomware to phishing to identity attacks.” The same report states that “Microsoft Threat Intelligence now tracks more than 1,500 unique threat groups including more than 600 nation-state threat actor groups, 300 cybercrime groups, 200 influence operations groups, and hundreds of others.”

Yet Businesses Still Don’t Invest

Despite an increasingly hostile cyber threat landscape, many companies delay investing in security, often waiting until legal mandates or catastrophic breaches force their hand. This hesitation stems from a complex interplay of factors: competing business priorities, a lack of tangible short-term returns on cyber investments, limited understanding of evolving digital risks, and the persistent belief that “it won’t happen to us.”

The Cost of Inaction

Delving into the financial and reputational damage caused by breaches, we can see that the consequences of inaction are severe. Companies that fail to invest in cyber security proactively often face significant financial losses, legal penalties, and damage to their reputation. For example, the MediSecure breach in May 2024 compromised information linked to approximately 12.9 million Australians, leading to significant financial and reputational damage for the company. Similarly, the HWL Ebsworth Lawyers breach resulted in an investigation by the Office of the Australian Information Commissioner (OAIC) and potential legal penalties.

When Small Businesses Become Big Targets

In the past two years, several small to medium sized Australian businesses found themselves at the centre of major investigations by the Office of the Australian Information Commissioner (OAIC) and Australian Competition and Consumer Commission (ACCC) due to preventable cyber incidents.

Despite widespread awareness of cyber threats, many organisations still rely on hope rather than preparation. Particularly smaller businesses that assume they’re too small to be targeted. But regulators don’t discriminate by size, and recent incidents show that even modestly resourced firms are now facing legal scrutiny when cybersecurity gaps lead to real-world harm.

Real-World Cases

One of the most significant breaches on record impacted MediSecure, an e-prescription provider, in May 2024. The ransomware attack compromised information linked to approximately 12.9 million Australians, including Medicare and prescription data. MediSecure entered administration shortly after requesting government financial assistance, which was refused. The OAIC’s investigation spotlighted failures in breach response and delay in notification highlighting systemic issues in process and governance.

In another incident involving HWL Ebsworth Lawyers, the OAIC initiated a privacy investigation in early 2024 after a breach reported in May 2023. The investigation focused on whether the firm met its obligations for timely breach notification and proper data-handling governance under the Privacy Act. If found that they have breached the Privacy Act by failing to handle data properly and not notifying promptly, HWL Ebsworth Laywers may face a combination of remedial orders, civil fines ranging from under $330,000 to tens of millions, enforcement notices, and private lawsuits, depending on how serious and systemic the OAIC finds its failings in governance, security, and breach notification.

While public detail is limited, this case signals the OAIC’s intent to hold all organisations, regardless of size or industry, to the same standards of privacy governance and accountability.

The most recent OAIC statistics covering July to December 2024 (released May 2025), show a record‑high 1,113 breach notifications for the year. Strikingly, 65% of these incidents involved organisations with fewer than 100 employees, highlighting that smaller entities are no longer under the regulatory radar. The OAIC’s growing attention to breaches at this scale sends a clear message: size won’t shield a business from accountability.

On the consumer compliance front, the ACCC has heightened scrutiny of marketing claims. While not pinpointed to a specific case, its 2025 compliance priorities include enforcement against businesses, especially e‑commerce firms, that advertise unverified encryption strengths such as “military-grade encryption” or overstate their security capabilities under Australian Consumer Law.

What’s most telling is that these breaches weren’t caused by elite hackers or complex threats. They stemmed from avoidable gaps: unpatched systems, poor controls, and missing response plans. And in nearly every case, the push to take action came only after intervention from regulators or the fallout of a public incident. It’s a reactive cycle that keeps repeating itself. Without legal pressure, meaningful cyber investment rarely comes first.

Don’t wait for a breach or legal action to dictate your priorities. The time to invest in security, and mean it, is before legal action comes knocking or your business lands in the headlines.

How Can Diamond IT Help?

At Diamond IT, we understand the critical importance of proactive cyber security measures. Our team of experts is dedicated to helping businesses of all sizes protect their valuable data and maintain their reputation. We offer a range of services, including:

• Comprehensive Security Assessments: Identify vulnerabilities and implement robust security measures tailored to your business needs.
• 24/7 Monitoring and Support: Ensure continuous protection with round-the-clock monitoring and expert support.
• Employee Training and Awareness: Equip your team with the knowledge and skills to recognize and respond to cyber threats.
• Incident Response Planning: Develop and implement effective response plans to minimize the impact of potential breaches.

Don’t wait for a cyber incident to force your hand. Contact Diamond IT today to learn how we can help you stay ahead of the threats and safeguard your business. Reach us through phone at 1300 307 907, email us at enquiries@diamondit.com.au or fill our the form below.