Data breach warning for Australian businesses in 2025 and 2026

Stolen credentials are circulating at a scale that is hard to picture. Security researchers confirmed 16 billion stolen login records sitting across 30 dark web databases in June 2025, the largest credential compilation ever recorded. That figure has kept growing as infostealer malware continues to feed fresh records into the dataset. If your staff reuse passwords across personal and work accounts, some of those credentials are almost certainly in circulation right now.

What is this credential leak and where did it come from?

The 16 billion record compilation is not a single breach of one company. It is an aggregation of roughly 30 underground datasets, built over several years by infostealer malware families that infected personal and corporate devices globally. These tools captured email addresses, plain-text passwords, active session tokens, and authentication cookies, then sold the logs on underground markets where operators bundled them into searchable databases.

Session tokens are a particular concern. Unlike passwords, they do not expire when you change your password. A session token captured from an infected device in 2024 may still be valid today if the underlying session has never been explicitly closed. That means a staff member who changed their password after a breach warning may still have an active, exploitable session open on a platform like Microsoft 365 or a business SaaS tool.

Why Australian businesses are at higher risk than most

Australia’s breach rate has climbed sharply. The Office of the Australian Information Commissioner (OAIC) recorded 1,205 notifiable data breach notifications in 2025, the highest yearly total since mandatory reporting began in 2018, and an 8% rise on 2024. Malicious or criminal attacks drove the majority of those notifications, at 716 cases.

The sectors most affected were health services (19% of notifications), finance (14%), and Australian Government agencies (13%). But the pattern we see across Queensland SMEs is that any business holding client data, legal, accounting, real estate, medical, logistics, is a viable target. Attackers no longer pick industries based on prestige; they pick based on the weakest link in the credential chain.

What credential stuffing means for your business

Credential stuffing is a straightforward attack. Criminals take a list of breached email addresses and passwords, then run automated bots that try those combinations at scale across hundreds of websites and services. They are not guessing, they are testing known passwords against accounts where people have reused them.

The superannuation sector felt this directly in March 2025. Coordinated credential stuffing attacks hit five major Australian super funds simultaneously, AustralianSuper, Rest Super, Hostplus, Australian Retirement Trust, and Insignia Financial. Over 20,000 accounts were compromised across the funds. Four AustralianSuper members lost a combined $500,000. Roughly 8,000 Rest Super members had personal data accessed. The attackers used passwords from earlier, unrelated breaches. The funds that were hit hardest had not enforced multi-factor authentication (MFA) at login.

If a staff member uses the same password for their super fund, their personal email, and their work Microsoft 365 account, a breach at any one of those services puts all three at risk.

How to check if your accounts have been exposed

The fastest check is Have I Been Pwned. Enter a work email address and it will show whether that address appears in any known breach dataset. The 16 billion record compilation from June 2025 has been progressively added to this service.

We recommend checking every email address your team uses, personal addresses included if staff use them for any work-related login. If any result returns a match, treat that account as compromised. Rotate the password immediately and revoke all active sessions, not just the password reset.

For businesses with a larger footprint, your IT provider can run a domain-level check against breach databases to identify all exposed accounts across your organisation at once, rather than checking addresses one at a time.

What to do after a breach warning

A breach notification is the start of the response, not the end. Here are the practical steps TTA recommends for any Queensland business that finds its credentials in a breach dataset.

• Reset the affected password immediately and revoke all active sessions on that platform.
• Turn on MFA for every account that supports it, especially Microsoft 365, email, banking, and any cloud-based business tool. MFA stops credential stuffing attacks even when the password is known.
• Audit whether any staff are reusing passwords across work and personal accounts. A business password manager like Keeper makes it practical to use unique passwords on every platform without anyone needing to remember them.
• Check for suspicious logins in your Microsoft 365 or Google Workspace admin portal, look for unfamiliar locations, devices, or login times in the last 30-90 days.
• If you find evidence of an unauthorised login, report it to the Australian Cyber Security Centre (ACSC) via ReportCyber and assess whether the incident triggers your obligations under the OAIC’s Notifiable Data Breaches (NDB) scheme.

The control that makes the biggest difference

Enforced MFA is the single most effective control against credential stuffing. AustralianSuper offered MFA to members but did not require it, regulators identified that gap as the primary reason the attack succeeded. The lesson for business is clear: optional MFA is only slightly better than no MFA.

Beyond MFA, email security filtering and DNS filtering reduce the risk of infostealer malware landing on devices in the first place. If the malware never executes, credentials never get captured. Data loss prevention (DLP) tools add another layer by flagging unusual data access that could indicate a compromised session is already active.

These controls work together. No single tool catches everything; the goal is to make credential-based attacks expensive enough that attackers move on.

What this means for your Privacy Act obligations

Australian businesses covered by the Privacy Act 1988 have a legal obligation to report breaches likely to cause serious harm to affected individuals. The OAIC’s NDB scheme requires notification as soon as a business becomes aware that a qualifying breach has occurred, there is no grace period to investigate quietly.

Penalties for failing to notify have increased. The Privacy Act reforms that came into force in 2024 raised the maximum civil penalty for serious or repeated interference with privacy to $50 million for a body corporate. For an SME, even a regulatory investigation is a significant operational disruption. Getting the basics right, MFA, patched software, secure credential management, is far less expensive than a breach response.

If you are unsure whether your current setup meets these requirements, a security audit is a practical starting point. It maps your current controls against known risks and gives you a clear picture of where gaps exist.

Frequently asked questions

What is credential stuffing and how does it affect my business?

Credential stuffing is an automated attack where criminals test stolen username and password combinations across multiple websites and services. If any of your staff reuse passwords between personal and work accounts, a breach anywhere in that chain can expose your business systems. The March 2025 Australian superannuation attacks showed how quickly this translates into financial loss, over $500,000 was taken from AustralianSuper members using credentials from older, unrelated breaches.

How do I check if my work email has been in a data breach?

Go to Have I Been Pwned (haveibeenpwned.com) and enter your work email address. The site checks the address against known breach datasets, including major compilations like the 16 billion record database identified in June 2025. If a match comes back, change the password immediately, revoke all active sessions, and turn on multi-factor authentication if you haven’t already.

Is my business legally required to report a data breach in Australia?

If your business is covered by the Privacy Act 1988 and a breach is likely to cause serious harm to individuals, yes. You must report it to the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. The Privacy Act reforms introduced in 2024 increased maximum civil penalties significantly, making early detection and response far more important than it was previously.

Does changing a password fix a compromised account?

Not completely. Changing a password stops an attacker from using that password again, but active session tokens captured by infostealer malware may still be valid after a password reset. You also need to explicitly revoke all active sessions on the affected platform. Most enterprise tools, including Microsoft 365, have an admin option to sign out all sessions across all devices.

What is the most effective control against credential stuffing attacks?

Enforced multi-factor authentication (MFA). When MFA is required at login, a stolen password alone is not enough to access an account. The Australian super fund attacks in March 2025 confirmed this: funds that had enforced MFA repelled the attacks; funds that offered MFA as optional did not. A business password manager prevents password reuse, which reduces the supply of usable credentials in the first place.

Where to from here?

If you want to know whether your business accounts are exposed, or you need help putting MFA and credential management in place, get in touch with the TTA team. We work with Queensland SMEs across professional services, health, logistics, and more, and we can run a domain-level breach check and give you a clear action plan, usually within a day.