What’s at Stake When Cyber Planning Gets Pushed Aside

Many organisations still treat cyber security as a technical problem or a future priority… until something goes wrong.

Australia’s high-profile breaches prove that delayed investment leads to far more than operational disruption. The consequences now include lawsuits, fines, and long-term damage to reputation and trust.

The Legal and Financial Risks Are Already Here

In 2022, Medibank suffered a major data breach exposing the personal and sensitive health information of 9.7 million Australians. By mid-2025, costs had already reached AU$126 million not including any penalties. In June 2024, the OAIC launched civil penalty proceedings claiming Medibank failed to take reasonable steps under the Privacy Act, pointing to missed alerts, weak contractor controls and lack of multi-factor authentication. Then in April 2025, the Australian Federal Court ordered Medibank to hand over internal cybersecurity reports, including Deloitte reviews, rejecting its claim of legal privilege. That ruling is now under appeal.

Optus, also in 2022, reportedly exposed around 10 million customer records including passports and licences triggering class actions, a CEO resignation in 2023, and public scrutiny. In May 2024, ACMA filed court proceedings, alleging breaches of confidentiality under telecom law. The legal case is still ongoing.

Most recently, in June 2025, Qantas reported a breach through a third-party call centre platform, impacting 5.7 million customers. While no financial or login data was exposed, names, contacts, and Frequent Flyer details were exploited. Qantas secured a Supreme Court injunction to limit use of the stolen data and is now under formal investigation following a complaint to the OAIC. The airline has since rolled out stronger cybersecurity controls, opened a 24/7 help line, and issued warnings about potential social engineering attacks including threats from the Scattered Spider group.

These are not isolated incidents. Each one shows how fast legal, operational, and reputational risks escalate when cyber planning is reactive instead of proactive. When that planning gets pushed aside, what’s really at stake is your ability to stay in control when everything’s on the line.

Tightening Regulatory Environment

Privacy reforms have raised the stakes significantly. Maximum penalties have jumped to AU$50 million or 30% of adjusted turnover for serious or repeated breaches. New ransomware reporting laws require public disclosure of extortion events, and the 2024 Cyber Security Bill has introduced mandatory cyber standards across both critical and non-critical sectors.

The message is clear: security is now a regulatory obligation. Failing to prepare leaves organisations exposed to legal, financial, and reputational consequences.

What Organisations Should Be Doing Now

Cyber security needs to be part of overall business governance. It must have visibility at the executive level and be managed as a core operational risk. Leadership teams must ensure their organisation has:

• Clear executive ownership of cyber risk and regular review at board level.
• Practical staff training and awareness initiatives that go beyond check-the-box eLearning.
• A solid understanding of third-party risks, with enforced controls for suppliers handling sensitive systems or data.
• A tested incident response plan that meets today’s legal requirements — not last year’s assumptions.

Frameworks like ISO 27001 or the ACSC’s Essential Eight are useful tools for identifying and addressing gaps. But the real value lies in translating those findings into board-level priorities, funding, and culture change.

Act Before You’re Forced Into Action

Preparation makes the difference between managing an incident and being overwhelmed by it. In every major breach, the fallout was made worse because key steps weren’t taken in advance.

If it’s been a while since your last security assessment, or if cyber still sits under “IT” in your org chart, it’s time to reset. The cost of action is almost always less than the cost of inaction.

How Can Diamond IT Help?

Talk to us about initiating a Cyber Risk Discovery exercise to identify where your business stands and what needs attention. Early action protects your business, your customers, and your reputation long before regulators come knocking. Contact us today on 1300 307 907, via email at enquiries@diamondit.com.au or fill out the form below.