Updated: Feb 4
Australia experienced a sharp rise in high-impact cyber-attacks over the last half-decade, ranging from crippling ransomware in logistics and essential services to unprecedented mass data breaches at major telecommunication and health-insurance providers. The research table below catalogues the most consequential events between 2020 and mid-2025, followed by an expansive analysis of attack patterns, root causes, and strategic lessons for organisations operating in the Australian threat landscape.
Toll Group, a critical logistics provider, endured two separate ransomware strikes within five months. The first incident in late January 2020 employed the Mailto strain, encrypting more than 1,000 servers and halting parcel tracking. Recovery took six weeks. In May, the newer Nephilim gang infiltrated Remote Desktop Protocol (RDP) endpoints, exfiltrated around 220 GB, and threatened leak-ware publication.
Key Technical Factors
Cyber criminals phished 47 Service NSW employees, gaining mailbox access that contained 3.8 M documents (730 GB). Manual analysis identified about 104,000 customers whose identity document licences, passports and birth certificates were exposed.
Key Technical Factors
On 15 May 2020, BlueScope detected ransomware in one of its U.S. subsidiaries; the infection propagated to Australian manufacturing operations, forcing plant shutdowns and manual steel dispatch.
Key Technical Factors
Late March 2021 saw two synchronous cyber events: parliamentary email outages and a sabotage-style breach at Channel Nine that blocked production of the flagship Weekend Today show. Although attribution remains contested, officials cited state-based tradecraft. Smartphones and tablets at Parliament malfunctioned, hinting at a mobile device management compromise.
An unauthenticated Optus API exposed to the internet retained a logic flaw from 2018 that disabled access checks. An attacker iteratively scraped the endpoint, acquiring personally identifiable information (PII) for 9.8 million current and former customers.
Threat actors obtained VPN credentials from a third-party IT contractor lacking MFA, installed malware, and exfiltrated approximately 520 GB of highly sensitive health data between August and October 2022. When Medibank refused a US$10 million ransom, hackers progressively leaked sensitive files.
The Vice Society gang struck on 15 December 2022, paralysing Fire Rescue Victoria's dispatch IT. Manual radio and pager procedures ensured emergency responses but increased crew workload. On 10 January 2023, Vice Society leaked HR files, budget sheets and applicant data on its Tor site.
Latitude's supplier environment was phished, allowing stolen SSO credentials to grant network entry and facilitate bulk theft of historic loan application data. Approximately 7.9 million driver licence numbers and transaction statements were stolen.
Across incidents, stolen or absent credentials (Medibank, Latitude) and unauthenticated APIs (Optus) were decisive. Mandatory hardware-based MFA and continuous identity assurance would have prevented or limited most breaches.
Optus and Medibank held years-old dormant customer records, greatly expanding breach scope. The Privacy Act's "destroy or de-identify" clause must shift from a compliance footnote to an operational imperative.
Toll, BlueScope, Fire Rescue Victoria and Medibank reveal a shift from pure encryption to data-leak coercion, forcing boards to improve exfiltration detection and incident response communications.
Latitude and Medibank demonstrate that third-party vendors remain the weakest link. Comprehensive third-party cyber risk management frameworks are increasingly non-negotiable.
Fire and ambulance services, steel mills and telecommunications providers illustrate adversarial interest in high-impact public services, aligning with global trends of disrupting societal functions for leverage.
Enforce least privilege, network micro-segmentation and continuous authentication.
Inventory, authenticate and rate-limit every endpoint. Adopt spec-first design with rigorous security testing.
Apply strict purging schedules and tokenise historic PII to mitigate breach impact.
Simulate ransomware and API abuse scenarios and validate incident response plans quarterly.
Embed contractual obligations for MFA, logging and breach notification within vendor agreements.
Conclusion
Between 2020 and 2025, Australia transitioned from sporadic ransomware incidents to nation-spanning data breaches that drove legislative change and redefined corporate cyber risk. The attacks chronicled here expose recurring gaps, including unguarded APIs, inadequate MFA and excessive retention of personal data. Organisations must embrace a zero-trust, data-minimalist approach, supported by board-level accountability and rigorous third-party oversight, to avoid repeating the costly lessons of the past half decade.