Coronavirus: cyber crime on rise as businesses warned of digital risks

Australian businesses are being exposed to data breaches as they shift advertising to digital platforms.

The Australian Information Commissioner reported 537 data-breach notifications in the last six-months of 2019.

Australian businesses facing COVID-19 economic shock are being exposed to data breaches and cyber attacks as they shift ­advertising to digital and social media platforms, including Google, Facebook and YouTube.

Cyber security experts have also issued a warning about the emerging risks to “household firewalls”, urging companies to review and update their software to mitigate threats as Australians shift to working from home.

Spending on cyber security is forecast to increase dramatically during and following the COVID-19 pandemic, with recent reports claiming malicious phishing email attacks related to the virus have increased 667 per cent since the end of February.

Sorin Toma, director of the Australian Cyber Security Forum and chief executive of Xpotentia, said the business models of digital companies, including Google and Facebook, was to “on-sell advertisers data to third parties”.

“Businesses have zero control or transparency as to where that information is sold and for what purposes it is used. It’s the main way cyber-criminals are able to get their hands on key business data,” Mr Toma said. “Businesses should be aware of the inherent risks in ­relying heavily on advertising with online giants. This is particularly the case if they are not conducting regular reviews and updates of their cyber security software.”

Mr Toma said Australian businesses should be looking at alternative ways of reaching markets online rather than “simply handing over mounds of data to faceless online juggernauts”.

The government’s Notifiable Data Breaches scheme, established in 2018, requires businesses who trade in personal information or have an annual turnover in ­excess of $3m to notify the Australian Information Commissioner and individuals affected by data breaches, which are likely to result in “serious harm”.

The AIC reported 537 data-breach notifications in the last six-months of 2019, with malicious or criminal attacks accounting for 64 per cent of notifications. The Australian understands the AIC is yet to impose any significant fines since the Privacy Act was changed.

Mr Toma said cyber risks for businesses were becoming “particularly acute” with more people working from home.

“The ability required to compromise household firewalls is a lot less than for large business servers,” he said.

Cyber Security Co-operative Research Centre chief executive Rachael Falk said changes to how Australians work through the COVID-19 pandemic had “demonstrated how incredibly agile cyber criminals are and their ability to capitalise on a crisis”.

“Cyber crime exists in the shadows and cyber criminals work from home, which is a key reason why they have been able to pivot so quickly. It’s because of this dynamism we’ve seen a spike in cyber crime during the pandemic, especially COVID-19 scams,” Ms Falk told The Australian.

“Developing rigorous cyber ­security technology is vital now and into the future to protect the data of governments, businesses and private citizens.”

Ms Falk, who is overseeing ­“future-focused research” combating the “ever-evolving threat” of cyber crime, said “we need to pivot and lean into the problem”.

With 48 per cent of businesses in the US switching advertising budgets during the coronavirus crisis, The Trade Desk Australia and New Zealand general manager James Bayes said privacy remained a key priority for advertisers.

The Australian earlier this year revealed the US digital ­advertising company was ramping up operations in Australia to take on Google and Facebook, pledging to not collect or trade user data. Mr Bayes said ­advertisers should “retain full transparency on where their advertisements are showing up and the content they are supporting”.