Nano Solutions
(08) 6365 5360 Book a Free Discovery Call

WA Cyber Attacks: What This Year's Audits Tell Perth Businesses

8 min read Petr Červenka Petr Červenka
cybersecurity perth business-tips
WA Cyber Attacks: What This Year's Audits Tell Perth Businesses
Photo by Nathan Hurst on Unsplash
On this page 7 sections
  1. Which WA cyber attacks and warnings matter this year?
  2. How did WA organisations actually lose money?
  3. Why do the same cyber security gaps keep showing up in Perth?
  4. How exposed is your business?
  5. What should Perth businesses do now?
  6. Frequently asked questions
  7. Sources

The short version

  • WA's Auditor General has published five reports on government IT security since December. The newest, on 30 September, found 33 known, attackable flaws in one agency system, unfixed for years.
  • The money lost came through email. A local government body paid about $350,000 after a supplier's bank details were changed. A state agency lost $71,000 through one taken-over inbox.
  • In both the state and local government audits, at least 60% of the problems found were left over from earlier years.
  • Most of the fixes cost little: call to confirm bank changes, use stronger sign-in, update quickly, and plan for a bad day.

WA cyber attacks rarely make the news the way a bushfire does, but the official record for 2026 is detailed. WA's Auditor General has spent the year publishing what goes wrong inside state agencies and councils, case studies included. This post pulls out what matters for anyone responsible for cyber security in a Perth business, council or agency, with a quick self-check at the end.

Which WA cyber attacks and warnings matter this year?

On the Office of the Auditor General (the OAG, the state's independent auditor) reported on the systems the Department of Water and Environmental Regulation uses to track contaminated land. It found 56 critical and high-rated security flaws in one system. Attackers already have tools for 33 of them, and those "have remained unpatched for several years". Users of a restricted dataset on a linked Landgate platform logged in with simple passwords and no multi-factor sign-in. The main system is so old that only one person at the vendor knows how to support it.

The threat is also local. On the AFP announced charges against two WA men over a campaign that allegedly hid harmful code in free software used by developers. The AFP says more than 1,000 organisations worldwide were potentially compromised. Both men are charged, not convicted. We covered it in The Supply Chain Attackers Lived Down the Road.

In August, two undersea cables linking Perth to Singapore and Sydney also developed faults at about the same time. The cause was unknown when reported; faults like these are commonly blamed on ships' anchors and fishing. Either way, it is a reminder to plan for the day your internet goes down.

The state has responded by making cyber its own priority. The WA Digital Strategy 2026-2030 names the Cyber Security Unit as the Hazard Management Agency for cyber incidents, the same emergency role other agencies hold for bushfires and floods.

How did WA organisations actually lose money?

Through email and trust, not clever hacking.

The OAG's local government report in March described a "social engineering attack": staff were tricked rather than systems hacked. The attacker got a supplier's bank account details changed in the finance system. About $350,000 went to an unknown third party before anyone noticed.

The same month, an audit of Microsoft 365 at seven state agencies described a senior officer's account taken over through a fake email. The attacker got past weak multi-factor sign-in, added an overseas device, and sent fake invoices. The agency lost $71,000.

This is business email compromise: a criminal gets into, or copies, a real email account and redirects payments. Businesses face it too. In ASD's latest Annual Cyber Threat Report, business email compromise that cost money made up 15% of cybercrime reports from businesses.

What one fake email cost, compared with an average small-business cybercrime report

WA local government body: supplier bank details changed$350,000
WA state agency: staff email account taken over$71,000
Australian average per small-business report, 2024–25$56,600
Pink bars are single WA incidents; the hatched bar is a national average, shown for scale. Sources: OAG WA Local Government 2025 and Microsoft 365 reports; ASD Annual Cyber Threat Report 2024–25.
A man at an office desk talking on his mobile phone, with a laptop open in front of him
A two-minute call to a number you already have would have stopped both losses. Photo by Vitaly Gariev on Unsplash.

Why do the same cyber security gaps keep showing up in Perth?

Because the fixes are dull, and dull work gets pushed back a year. Most of what the auditor found had already been reported before.

Share of audit findings left unfixed from earlier years

State agencies (359 findings at 53 agencies)65%
Local government (333 weaknesses at 68 bodies)60%
Sources: OAG WA State Government 2025 (December 2025) and Local Government 2025 (March 2026) information systems audit results.

Access control was the weakest area in both reports. That means who can log in, to what, and how they prove who they are. In the local government report, the auditor assessed 15 bodies in depth against a benchmark.

The examples are ordinary. One body left the factory-default password on the admin login for its building management system, which runs heating, lighting and doors. At another, critical servers could be reached from the public library. As Auditor General Caroline Spencer put it, improvement "requires an ongoing awareness of risk and constant effort".

How exposed is your business?

Private businesses are not audited like this, but the same gaps are usually there. Six questions, based on what the WA audits keep finding:

Quick self-check

Before changing a supplier's bank details, do you phone them on a number you already had?

This is how the $350,000 went. Make the call-back a written rule for whoever pays bills.

Does every email account need a second sign-in step from an app or security key, not just a text message?

Weak multi-factor sign-in let the attacker into the $71,000 account. Start with whoever approves payments.

Are security updates for computers and browsers installed within two weeks?

Turn on automatic updates and check they actually install. Old, unpatched flaws are what the September audit found.

Have you changed the default password on everything with an admin page: Wi-Fi, printers, cameras, door systems?

Default passwords are published online. List the devices and change them.

Do you have an offline backup that you have restored from in the last six months?

A backup you have never restored is a guess. Test one this month.

Do you know which outside providers hold your customer or staff data, and how they store it?

One WA agency's records on 32 people were exposed after a provider stored them in Dropbox. Make a list and ask.

Count your "no" answers. Each one is a gap WA auditors keep finding.

No gaps on these six questions. The Essential Eight self-assessment goes further.

gaps. Each fix above is an afternoon's work, not a project. Start with the money ones: questions 1 and 2.

gaps. That is the pattern behind the WA losses in this post. Work through the fixes above, or talk to us about where to start.

For the fuller picture, try the free Essential Eight self-assessment.

What should Perth businesses do now?

  1. Never change bank details on the strength of an email. Call the supplier on a number you already have, and make sure whoever pays bills knows they will never be in trouble for checking.
  2. Use stronger sign-in protection. An authenticator app or security key beats text-message codes, especially for anyone who approves payments. Our multi-factor authentication guide explains the options. Ask whoever manages Microsoft 365 to alert on new devices too.
  3. Update quickly, and replace what cannot be updated. The Essential Eight sets clear timeframes. A system only one person can support needs a replacement plan.
  4. Change every default password on printers, Wi-Fi, cameras and door systems.
  5. Plan for a bad day. Keep offline backups you have tested, write down who to call, and save ASD's 24/7 hotline: 1300 CYBER1 (1300 292 371). You can report at cyber.gov.au/report.

To see how your setup holds up against a real attacker, that is what a penetration test is for.

Frequently asked questions

Does the Auditor General's work apply to private businesses?

Not directly. The OAG audits state agencies, universities, TAFEs and local governments. But fake supplier bank details and stolen email accounts work the same way on a private company.

Are WA organisations targeted more than others?

The sources we read do not say that, and we have not seen state-by-state figures that would show it. What they show is that WA organisations face the same common attacks as everyone else, and that the attackers can be local.

If you want help working out which of your systems need attention first, talk to our cyber security consulting team or get in touch.

Photo credits. All images used under the Unsplash License — free for commercial use, attribution appreciated:

Sources

Was this useful?

Share

Markdown
Petr Červenka

Petr Červenka

Petr is the founder and lead developer at Nano Solutions, a Perth-based custom software firm. With over a decade of experience building enterprise platforms for government and private sector clients, he leads delivery of complex projects across Australia.

Connect on LinkedIn