Australian SMEs are being warned that they are vulnerable after Optus hackers accessed the personal information of up to 10 million Australians.
“This is very serious and has the potential to create a business email compromise storm,” Phil Parisis, General Manager of Products at My Business, the largest small-business organisation in Australia, said.
It has been determined that Optus was hacked through business email compromise (BEC), wherein hackers gain unauthorised access to or impersonate an email account to intercept private communications. Criminals are then able to intercept financial transactions such as invoices or scam other organisations out of money and goods.
Parisis said that the extent of the breach was further aggravated by the fact that more than 60 per cent of small-business owners are using the same email/password for their Optus account as they do for other critical business systems, not to mention employees using the same password that’s been breached or suppliers and clients.
According to the Australian Cyber Security Commission, business email compromise cost businesses $81.45 million in 2020-2021. In addition, the Australian Small Business and Family Enterprise Ombudsman has revealed in its latest data that more than 60 per cent of Australian SMEs do not survive a cyber-attack.
“We often hear from small businesses that ‘I’m just a retailer, a designer; why would anybody target me?’ The reality is that cyber criminals don’t necessarily target you,” Parisis said. “Mostly, you become an accidental victim of a large, broad-scale attack such as what’s happened to Optus. It’s also a good reminder for SMEs to look at their own cybersecurity because if it can happen to a huge company like Optus imagine how easily it can happen to them.
“Small business is big business for cyber criminals,” Parisis added. “Cybercriminals are savvy, they know that by taking on larger organisations they can then branch out and hit smaller businesses too who knowingly have less resources, time and budget to protect themselves.”
Parisis said the attack should serve as a warning to all businesses. “If it can happen to a huge organisation like Optus with all the firewalls at their disposal, imagine how easily it can happen to smaller companies,” he concluded.
