Cyber security isn’t just a concern for large corporations and government departments. For small and medium businesses, a compromised email account, stolen password, ransomware attack or fraudulent invoice can have serious financial and business consequences. Potentially, a cyber attack could be a very serious event for your business.
Cybercrime can be expensive
A common misconception is that small businesses are unlikely to be targeted because there is less money or information available to steal. In reality, small businesses are attractive targets because they often have fewer resources devoted to cyber security and are seen as easy targets.
The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) received more than 84,700 reports of cybercrime during 2024–25. The average self-reported cost per cybercrime report was about $56,600 for small businesses and $97,200 for medium businesses.
These are average reported costs. So individual incidents can cost considerably more or less. For a real (but very dry) look at how serious an attack can be look at the statistics from the Australian Bureau of Statistics.
The financial impact can include:
- Money lost through scams or fraudulent payments
- Lost trading time while systems are investigated or restored
- IT and cybersecurity specialist fees
- Replacing compromised equipment
- Recovering or recreating lost data
- Legal and professional advice
- Potential regulatory or privacy consequences
- Damage to customer confidence and the business’s reputation
For a small business, even a relatively modest incident can become a significant expense.
Data breaches aren’t just about stolen credit cards
Businesses hold much more sensitive information than they sometimes realise. Depending on the business, this might include customer names, addresses, telephone numbers, email addresses, identification documents, financial information, employee records and information supplied through website contact forms.
A data breach can occur through hacking, malware or ransomware, but it can also happen through a simple mistake — such as sending confidential information to the wrong person or accidentally exposing information online.
The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications during 2025, the highest annual number since Australia’s mandatory data breach reporting scheme commenced in 2018. Hacking remained the most common cause.
Not every small business is covered by the Privacy Act. Generally, businesses with annual turnover of $3 million or less are not covered, although there are important exceptions. Even where the Privacy Act does not apply, protecting customers’ personal information is sensible business practice.
What would your customers think about you being responsible for losing their data?
Seven practical security measures
1. Use a password manager
Using the same password for several different services is a huge security risk. If criminals obtain that password from one website, they may try it against the business’s email, accounting, banking or other systems.
A password manager or password vault can generate strong, unique passwords for each account and store them securely. Employees don’t need to remember dozens of long and complicated passwords, or keep them in spreadsheets, documents or (or on a “post it” note stuck to their monitors).
Business-oriented password managers can also make managing access much easier. Each employee can have their own account and be given access only to the passwords they need for their job. Someone who manages social media, for example, doesn’t necessarily need access to the website administrator’s credentials or the accounting system.
When an employee leaves, their access can be removed without having to track down every password they may have been given.
A good password policy should include:
- A different password for every important account
- Long, randomly generated passwords where passwords are required
- Passwords stored in a reputable password manager
- No passwords stored in spreadsheets or shared documents
- Prompt removal of an employee’s access when they leave
2. Consider passkeys
Passkeys are a newer alternative to traditional passwords and are increasingly supported by major online services.
Instead of relying on a password that can be stolen or phished, a passkey uses cryptographic credentials stored on a user’s device or password manager. If you store your passkey in your password manager (it’s normally stored on your individual device) it can then be used on any device you have your password manager set up on.
One of the major advantages is that there is no password for a criminal to trick the user into entering on a fake website. Passkeys are designed to resist phishing and can also eliminate many of the problems associated with password reuse and stolen credentials.
Where important business services support passkeys, businesses should consider enabling them, particularly for administrator and other high-privilege accounts.
3. Use multi-factor authentication
A password alone is not enough to protect important accounts.
Multi-factor authentication (MFA) requires an additional verification step when someone logs in. This might be an authentication app, security key or some other verification method.
Enable MFA wherever it is available, particularly for:
- Online banking
- Accounting software
- Microsoft 365 or Google Workspace
- Website administration
- Cloud storage
- Social media accounts
- Password-manager accounts
A compromised email account can be particularly damaging because criminals can use it to reset passwords, impersonate the business or intercept financial information.
4. Keep software and devices updated
Software updates frequently contain security fixes for vulnerabilities that criminals may otherwise exploit.
Enable automatic updates where practical and make sure computers, phones, routers, websites, plugins and other internet-connected systems are regularly updated.
This is particularly important for businesses running their own websites. An outdated content management system or plugin can provide an entry point into the website or hosting environment.
5. Back up important information
A good backup can be the difference between a really serious disruption and a recoverable incident. Think about it, if you open up the computer on Monday morning and there is nothing there – could your business recover from that?
Important business information might include accounting records, customer databases, contracts, documents, website files, photographs and other business assets.
Backups should be tested periodically. A backup that has never been tested may not be a backup you can actually rely on when you need it.
Where possible, businesses should also ensure that backups cannot simply be deleted or encrypted by someone who has compromised the main network.
The ACSC recommends backups as one of the basic security measures small businesses should take, alongside MFA and keeping software updated.
6. Train your staff
Technology is only part of cyber security. People are often the target and social engineering is often how the attack is made.
Staff should be trained to recognise suspicious emails, fake login pages, unexpected attachments, requests for passwords, urgent payment requests, fake invoices and unexpected requests for confidential information.
One particularly important rule is to independently verify changes to bank account details.
Scammers can compromise business email accounts and then alter invoice payment details. The email may appear completely genuine because it really does come from a legitimate account or sits within an existing email conversation.
If a supplier tells you that their bank account has changed, contact them using a telephone number or other contact method you already have — not simply the details contained in the email.
7. Limit access and have a response plan
Not everyone in a business needs access to everything.
Use individual accounts for employees wherever possible and give people only the access they need to perform their jobs. When an employee leaves, promptly remove their access to email, cloud services, accounting systems, websites and other business applications.
It’s also worth thinking in advance about what you would do if something goes wrong.
What happens if your email account is hacked? What if your computers are encrypted by ransomware? What if a fraudulent payment is made or customer information is stolen?
Decide who should be contacted, which systems should be disconnected, where your backups are located and who has authority to make important decisions.
Having a plan can save valuable time during an incident.
What happens after a data breach?
If your business is covered by Australia’s Privacy Act, certain data breaches may be subject to the Notifiable Data Breaches (NDB) scheme.
Where an eligible data breach is likely to result in serious harm and the risk cannot be prevented through remedial action, the organisation must notify affected individuals and the OAIC.
The Privacy Act has important exemptions and exceptions for small businesses, so businesses should establish whether they are covered rather than assuming that the $3 million turnover threshold tells the whole story.
The OAIC recommends having a data breach response plan so that a business can respond quickly and meet its obligations if a breach occurs.
Free government resources
You don’t necessarily need an expensive cybersecurity consultant to get started. The Australian Government provides a range of free resources for small businesses.
Australian Cyber Security Centre (ACSC)
The ACSC provides small-business guidance covering MFA, software updates, backups, securing devices and responding to cyber incidents. It also provides a Cyber Health Check Tool.
Business.gov.au
Business.gov.au provides a practical cyber security checklist covering passwords, MFA, software updates, backups and other measures.
Small Business Cyber Resilience Service
Eligible small businesses can access free, tailored, one-to-one assistance to improve cyber security and recover following a cyber incident. The service is available to Australian small businesses with 19 or fewer full-time equivalent employees, including sole traders.
Scamwatch
Scamwatch provides information about current scams and practical advice for businesses, including fake invoices and payment redirection scams.
Cyber security is a business issue
Cyber security shouldn’t be viewed solely as an IT problem.
A successful cyber attack can affect cash flow, accounting, operations, customer relationships, compliance and the reputation of the business. For a small business, where a handful of people may be responsible for most day-to-day operations, the disruption can be particularly significant.
The objective isn’t to create a perfect security system. It is to identify the information and systems that matter most to your business, reduce the obvious risks and make sure you can recover if something goes wrong.
A few straightforward measures — particularly password managers, unique passwords, passkeys, MFA, regular software updates, reliable backups and staff awareness — can substantially improve a business’s security.
Postscript: What about artificial intelligence?
Artificial intelligence is becoming another important part of the cyber security picture. For businesses, AI presents both risks and opportunities.
The risks
Generative AI makes it easier for criminals to produce convincing emails, messages and other fraudulent content. AI can also assist attackers in identifying vulnerabilities and conducting attacks more quickly.
There is another risk that is particularly relevant to small businesses: the information employees put into AI services.
An employee might paste a customer email, contract, financial information or employee details into an AI tool to ask for assistance. Depending on the service, subscription and settings, information submitted to an AI platform may be stored or handled by the provider in ways the business has not considered.
Businesses should establish clear rules about what information can and cannot be entered into AI services. Employees should also understand that AI-generated information can be incorrect and should be checked before being relied upon.
The opportunities
AI can also help improve cyber security. It can assist with analysing information, identifying unusual activity, summarising security alerts, drafting policies and procedures, and providing cybersecurity information in a form that non-technical staff can understand.
AI can therefore become another useful tool for a small business’s security efforts — even when the business doesn’t have dedicated IT or security staff.
The sensible approach is not to avoid AI altogether. Instead, businesses should introduce it deliberately, understand what information is being provided to AI systems, check the privacy and security settings of the services they use, and establish appropriate rules for employees.
AI can be a valuable business tool — but, like any other technology, it needs to be used with appropriate safeguards.
