Financial services now have the most expensive breaches in Australia: what the 2026 numbers mean

blank

Financial services now have the most expensive breaches in Australia: what the 2026 numbers mean

blank

Our Services

Every year, IBM’s Cost of a Data Breach Report gives Australian businesses a clear benchmark for what a security incident costs. It’s one of the few studies of its kind that lets organisations compare their own exposure against a large, consistent global dataset year after year.

The 2026 edition, published on 31 July 2026, examined breaches experienced by 602 organisations globally between March 2025 and February 2026. As in previous years, the report breaks these findings down by industry and region, giving a picture of how different sectors are faring against the same threats. Buried in the Australian results are several findings financial services leaders can’t afford to overlook.

The numbers

The average cost of a data breach in Australia has risen toAUD $4.22 million, up 38 per cent since 2019.

Financial services recorded the highest average breach cost of any sector in the country, at AUD $6.31 million per incident (IBM, 2026). It is now the most expensive sector in Australia to experience a breach, ahead of every other industry IBM measured this year.

It helps to understand what that figure represents, because it is easy to read it as a single dramatic event and move on, however, it isn’t one. It is an average, built up from incident response, forensic investigation, regulatory notification, lost business and the time it takes a Financial Services firm to identify and contain an issue once it has started.

For a sector that holds sensitive client information and moves money for a living, each of those components tends to run longer and cost more, and the total adds up quickly.

A trend, not a spike

The cost figure lines up with what’s happening on the reporting side too. The Office of the Australian Information Commissioner received1,205 data breach notifications in 2025, the highest number since the Notifiable Data Breaches scheme began in 2018, and an 8 per cent increase on the 1,112 notifications recorded in 2024 (OAIC, 2026). A consistent picture can be seen when you read the two data points together.

Breaches are being reported more often across the board, and when they land in financial services, they cost more to resolve than anywhere else.

None of this means Financial Services firms are doing something wrong, it reflects the nature of the work being completed. Businesses in this sector hold information and manage transactions, so a breach is not just costly to put right, it also comes with strict reporting obligations to regulators.

blank

Where the value sits

What the figure highlights is the value of preparation before an incident, not after one. The businesses that survive a breach with less damage rarely do so by chance. They usually have a plan that was written and tested well before it was needed, so the first hour of an incident is spent executing it rather than working out where to start.”

Picture two businesses hit by a similar incident on the same day. One already knows who gets notified, in what order, and what the client message says, before anyone’s written a word of it. The other is figuring all of that out for the first time, with the clock already running. That gap, in cost and in client trust, is most of what this report is measuring.

Closing that gap doesn’t call for a finished plan overnight, and it doesn’t need to be perfect on the first attempt, it just needs to exist before it’s tested for real.

How can we help you?

Join us for a Cyber Webinar Series where we unpack practically how you can learn and discover how to not only protect your environment, but who has access to it and what information they have access to. 
 
More information is found here: 
https://danet.com.au/webinar-series-three-cyber-security-questions-every-business-owner-has-to-answer/

If you’d like to talk through what this means for your business, contact us.

danet.com.au

blank

Please get in touch with our team

Sources

OAIC, Data breach notifications increase to all-time high in 2025, new NDB stats show (published 6 July 2026): https://www.oaic.gov.au/news/media-centre/data-breach-notifications-increase-to-all-time-high-in-2025,-new-ndb-stats-show

IBM, Cost of a Data Breach Report 2026: https://www.ibm.com/reports/data-breach

What APRA’s AI Letter Signals for Every Regulated Business

blank

What APRA's AI Letter Signals for Every Regulated Business

blank

Our Services

In April 2026, APRA wrote to industry with a message that was hard to misread. It called for a step-change in how banks, insurers and superannuation trustees manage the risks that come with artificial intelligence, warning that governance, risk management, assurance and operational resilience are not keeping pace with how quickly AI is being adopted.

The letter followed a targeted review of some of the country’s largest financial institutions. While it is directed at APRA-regulated entities, the observations read like a checklist for any organisation now weaving AI into everyday work. The themes are familiar to anyone who has watched a new technology move faster than the structures built to govern it.

Here is what the letter actually says, and why it matters well beyond the entities it was addressed to.

Adoption is racing ahead of governance

APRA found that every entity it engaged with is actively adopting AI, and many are moving beyond internal productivity experiments into customer facing uses such as claims triage, loan processing, fraud detection and customer interaction.

Governance has not matured at the same speed. APRA noted a tendency to treat AI risk as just another technology, which misses what makes AI different. Models can adapt over time, produce unpredictable outputs and carry considerations such as bias and data handling that traditional systems do not. The result is gaps across the AI lifecycle, particularly in monitoring how models behave once they are deployed.

At board level, APRA observed strong enthusiasm for the benefits of AI, but also that many boards are still building the technical literacy needed to challenge and oversee AI decisions. In some cases there was an overreliance on vendor presentations rather than independent examination of the risks.

AI is changing the cyber threat landscape

The letter is clear that AI is not only a productivity story. It is also reshaping how organisations are attacked.

APRA pointed to new attack pathways, including prompt injection, data leakage through AI tools, insecure integrations and the misuse of autonomous AI agents. AI can shorten the attack cycle, allowing incidents to move with more speed and coordination than before.

One observation deserves particular attention as adoption grows. Identity and access controls in many organisations have not yet adjusted to non-human actors, such as AI agents that can act inside systems on a user’s behalf. At the same time, staff use of AI tools outside approved control frameworks remains a concern, with many organisations relying on policy rather than enforceable technical controls.

Supplier concentration and opacity are real risks

APRA observed some entities heavily dependent on a single provider for multiple AI use cases, often without tested exit or substitution plans. Because AI capability is increasingly embedded inside software and platforms, the upstream dependencies, such as foundation models and the data behind them, can be opaque. That makes it harder for an organisation to independently assess how a model performs, where its data goes and how resilient it is.

blank
blank

Assurance built for static systems is not enough

Traditional change management and point-in-time assurance were built for systems that behave the same way each time. APRA noted these methods are ill-suited to probabilistic models that learn, adapt and degrade over time, and that few entities had continuous monitoring in place to detect issues such as model drift. Internal audit and risk functions were often found to lack the specialist skills and tooling to assess AI systems.

What APRA expects

Underneath the observations, APRA set out clear expectations. At a minimum, entities should

  • Maintain board and executive literacy sufficient to set strategic direction and provide genuine challenge on AI risk.
  • Run an AI strategy aligned to the organisation’s risk appetite, supported by monitoring and reporting.
  • Keep an inventory of AI tooling and AI use cases.
  • Assign ownership and accountability across the AI lifecycle, from design through to decommissioning.
  • Keep people involved in high-risk decisions.
  • Train staff on AI use, misuse, limitations and secure practices.
  • Map the full AI supply chain, including third and fourth-party dependencies.
  • Apply continuous, integrated assurance across security, data governance, model performance and privacy.

APRA also signaled that where entities fail to manage AI risks proportionately, it will take stronger supervisory action and, where appropriate, pursue enforcement.

Why this matters beyond APRA-regulated entities

APRA regulates banks, insurers and superannuation trustees. Financial advice licensees sit under ASIC, which delivered a strikingly similar message in its own May 2026 letter describing cyber resilience as being at a minute to midnight and stressing that boards must be able to evidence that controls are actually working, not just designed.

Two regulators, weeks apart, landed on the same point. AI adoption is moving faster than governance, and the expectation is shifting from intent to evidence.

Where to start

For most organisations, the honest starting point is simpler than a strategy document. It is visibility.

Many businesses cannot yet answer a basic question: where is AI already being used across the organisation, including the AI features quietly switched on inside the software we already run? Building that inventory is where responsible adoption begins. From there, the familiar disciplines apply. Align access to what each person, and each agent, genuinely needs. Keep people accountable for high-risk decisions. Make sure the information AI can reach is well organised and governed underneath.

That last point is where much of the real work sits. Tools like Microsoft Copilot operate on the information users already have access to, which means the value they deliver, and the risk they carry, is shaped by how well that environment is structured. For many organisations, AI is not creating new governance questions so much as bringing existing ones into sharper focus.

At Danet, this is the conversation we are having with clients across regulated industries. Not whether to adopt AI, but how to build the visibility, identity controls and information governance that let an organisation adopt it with confidence.

If your organisation is working through what responsible AI adoption looks like in practice, get in touch.

blank

Please get in touch with our team

Sources

APRA, Letter to Industry on Artificial Intelligence (published 30 April 2026): https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai

ASIC, open letter on cyber resilience and AI (May 2026), as summarised by Clayton Utz, “The clock is at a minute to midnight”: “The clock is at a minute to midnight”: ASIC’s ope… | Clayton Utz

ASIC, Cyber resilience regulatory resources: Cyber resilience | ASIC

Australian Signals Directorate (ASD), Annual Cyber Threat Report 2024-25 (context on the evolving threat environment): https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025

How AI hallucinations could land for AFSL holders

blank

How AI hallucinations could land for AFSL holders

blank

Our Services

What the legal profession has already learned about AI, and the simple step Australian financial services firms can take this week.

With 90% of industry leaders believing AI will improve service and efficiency in their firms,attention is now turning to how this technology is integrated into everyday workflows, and how its behaviour shapes outcomes.

A specific pattern emerging is AI hallucinations, where AI recognises objects or patterns that don’t exist or that humans are unable to see.

The problem with this? Inaccurate, invented responses, with no supporting evidence or insight, and errors hard to detect due to the confidence AI responds with.

AI is going to be part of every Australian financial services organisation, the right approach is choosing the version that protects your client data.

AI hallucinations in the real world

In 2023, AI hallucinations appeared in the legal case of Mata v. Avianca. An attorney was representing an injury claim for a client, using ChatGPT this produced references that did not exist in the legal research.

It also falsely claimed the references came from a reputable legal database, revealing how far AI can go in producing inaccurate outputs.

The knowledge base AI utilises continued to be undermined. From 2023-2025, cases like these kept emerging, with judges worldwide issuing hundreds of filings, 90% of them in 2025 alone.

For AFSL holders, in a Statement of Advice, this can land as AI-generated errors appearing as verified content, which risks consumers being misled by incorrect facts and insights.

Why this matters to AFSL holders

AFSL holders need to ensure that consumers aren’t unethically treated through vulnerability exploitation and potential AI bias.

The accuracy of insights and facts produced to consumers must also oblige ensuring AI information isn’t misleading, unexplained, or inaccurate.

Under directors’ duties, responsibilities must be undertaken carefully and diligently when considering reliance on information from AI and the risk that it holds.

Without upholding these obligations, an uncaught hallucination in a Statement of Advice, client email or compliance file note becomes an AFCA complaint, a breach report, and a remediation bill the licensee carries.

A confident approach to AI

For AFSL holders to ensure they can meet these obligations, Microsoft 365, specifically Microsoft Copilot, is a safe way to implement AI. Designed specifically for enterprise, Copilot operates within an organisation’s tenant.

The benefits of Microsoft 365 involve:

Data protection and strict permissions: Adheres to an organisation’s existing data permissions and information, no exposure of organisational data to train the public AI model.

Automated compliance:Finds regulatory changes and prepares for audits, allowing adherence to compliance standards.

Microsoft purview:Prevents unauthorised data sharing, monitors AI prompts, and classifies sensitive data.

Many organisations already have these capabilities within their environments, they just haven’t been optimised yet. For financial services organisations, accuracy can be enhanced through role-specific AI agents, allowing for automated data reconciliation.

Reliable and permitted outputs can also be achieved through a strong SharePoint architecture and governed data access, allowing Copilot to search through categories.

The next 3 steps

There are a series of steps AFSL holders can take to ensure continued confidence within their environments.

  1. Embed Copilot through existing applications and actively update databases
  2. Ensure data governance through implementing restrictions and Microsoft Purview
  3. Updating policies around AI that mandate human review

These measures ensure Copilot can function optimally in your environment while maintaining data and access governance supported by updated AI policies.

Why Danet

With AI being part of how financial services will operate in 2026 and beyond, hallucinations will progressively surface.

Those who move first with the right version of AI will benefit from the productivity without the privacy risk.

Danet works with organisations to align Microsoft 365 and Copilot to their environments to ensure confidence and compliance with the use of AI, through designing and continuing to update the structures of databases and workflows.

These themes are further explored in Danet’s AI Guide for AFSL Leaders, determining how AI capabilities can be implemented into Microsoft 365 environments and how governance oversight shapes this.

Download the Guide

A new phishing pattern in Microsoft 365

blank

A new phishing pattern in Microsoft 365

blank

Our Services

Phishing continues to evolve alongside the way organisations collaborate.

 As work becomes more connected within Microsoft 365, attackers are adapting their methods to reflect that connectivity.

A pattern now emerging involves compromised Microsoft accounts and legitimate Microsoft SharePoint file sharing. Rather than relying on suspicious links or external impersonation, the technique operates within trusted channels that employees use every day.

Understanding how this works supports both technical response and user awareness.

How the method works

This technique follows a structured sequence:

  1. A legitimate Microsoft account is compromised. Access may have been obtained through credential reuse, earlier phishing, or password exposure.
  2. The attacker uses Microsoft SharePoint to share a genuine file from that real account. The recipient receives a standard SharePoint notification from a recognised contact.
  3. When the file is opened, a Microsoft sign-in prompt appears. The prompt mirrors the usual Microsoft authentication experience.
  4. If credentials are entered, access extends further.

At that point, the attacker is operating inside the organisation’s Microsoft 365 environment as a legitimate user. Collaboration patterns continue as normal, which allows exposure to expand through routine sharing.

This pattern is often described as a secondary attack. Even when most employees act carefully, a single compromised identity can create a downstream impact through everyday workflows.

Why this spreads quickly

Microsoft 365 is intentionally designed to support connected work. Within that environment, Microsoft SharePoint governs how information is shared, Microsoft Teams structures collaboration in shared digital spaces, and Microsoft Outlook sustains communication across the organisation.

These capabilities are central to productivity. When an attacker operates from a legitimate account, the same collaborative design that supports productivity also supports internal movement. Within that environment:

  • File shares appear consistent with normal collaboration
  • Authentication prompts align with expected workflows
  • Access extends through established trust relationships

The compromised identity carries organisational credibility, allowing activity to continue without immediate suspicion.

Where AI changes the equation

The introduction of AI capabilities such as Microsoft Copilot adds another dimension to this pattern.

Microsoft Copilot surfaces insight based on existing permissions across Microsoft 365, reflecting the structure and governance already in place. When identity controls align with role accountability and information architecture is clearly defined, AI supports productivity within those boundaries. Visibility within the environment is shaped directly by how access has been configured.

AI also influences how phishing techniques continue to develop. Generative tools allow attackers to produce communication that reflects organisational language and context. Messages can align closely with current projects or recent activity, which reduces obvious inconsistencies in tone or workflow.

Once access is established, AI-driven tools can assist with navigating large volumes of information or identifying high-value content more efficiently. This places greater emphasis on maintaining well-defined access boundaries and regularly reviewing how permissions are assigned within Microsoft Modern Workplace.

As organisations expand their use of AI, the relationship between Microsoft Modern Workplace design and responsible AI adoption becomes increasingly interconnected.

What to watch for

User awareness remains one of the most effective safeguards.

Pause when you notice:

  • A Microsoft SharePoint file share arriving without prior context
  • An authentication prompt appearing outside your usual workflow
  • A request from a known contact that feels inconsistent with recent activity

Verification through an alternate communication channel is a simple and effective control. Taking a moment before entering credentials can interrupt the progression of secondary compromise.

Strengthening the structural response

Key areas for review include:

  • Conditional access configuration within Microsoft Entra ID
  • Multi-factor authentication coverage
  • Microsoft SharePoint external sharing settings
  • Monitoring for unusual sign-in behaviour

These measures are not about limiting collaboration. They ensure that identity, access, and sharing controls remain aligned as Microsoft 365 usage expands and new technologies are introduced.

Cyber awareness training should also evolve to reflect that phishing techniques now operate within trusted platforms, instead of solely through external email campaigns.

A connected environment requires connected awareness

As work becomes more integrated within Microsoft 365, phishing techniques increasingly reflect that integration. Effective defence combines disciplined identity governance with users who recognise how trust can be leveraged within connected environments.

Designing and maintaining that structure requires a deep understanding of identity architecture, Microsoft SharePoint governance, access control design, and information protection within Microsoft 365.

Danet works with organisations to align Microsoft Modern Workplace environments to operational requirements and security standards, ensuring collaboration remains seamless while governance remains embedded.

Connected work brings opportunity. With considered design and ongoing oversight, organisations can support secure collaboration, responsible AI adoption, and sustained growth.

blank

Please get in touch with our team

ROUNDTABLE: AI & Actionable Insights for Business Leaders

blank

March 30 | 4:00pm AEDT

Hybrid Format | Join us in Sydney or Online via Microsoft Teams

secure your place
blank

AI is everywhere.

What’s missing is a practical, honest conversation about how it improves business performance.

This event is designed as aleadership round table.

We will discuss what is really happening in the market, what business leaders are implementing, and where AI is delivering measurable results.

Hear from Industry Experts

blank

Daniel Butt

Founder & CEO, Danet Technology

Over 21 years leading secure technology strategy for Australian businesses. Daniel works closely with organisations navigating governance, compliance, operations and growth in increasingly complex digital environments.

blank

Phil Meyer

Former Microsoft Leader | 45+ Years in Enterprise Technology

Phil brings more than 45 years of experience in business systems, enterprise transformation and applied AI. Having worked extensively inside Microsoft and with enterprise organisations, he offers deep insight into how AI is being implemented beyond basic productivity tools.

A roundtable discussion

Together, Daniel and Phil will facilitate a practical, open discussion grounded in real world scenarios.

You will:

  • Hear the current state of play in AI adoption
  • Review insights from the AI & Your Business survey
  • Participate in a guided round table discussion
  • Engage in live Q&A
  • Hear perspectives from industry peers and colleagues

This session is structured around conversation and shared insight.

blank

Attend In Person or Online

If you are based in Sydney, you are warmly invited to join usin person at the Danet Technology office.

Light refreshments will be provided.

The session will integrate both in-room and remote speakers to ensure full participation and a genuinely great experience.

Your voice will be important within this conversation and encourage you to participate throughout the engagement.

What we will discuss:  

  1. Business process improvement and system connection
    We will explore how leaders are using AI to improve operational performance, reduce friction and make more informed decisions  
  2. Practical, relatable examples for small to medium enterprises
    We will focus on tangible applications suited to SME’s to improve efficiency, accuracy and continuity.   
  3. Customer experience
    We will discuss how organisations are improving customer interactions through AI as a competitive advantage. 
  4. AI applications and tools
    There is significant confusion around tools such as Copilot, Gemini and Claude. We’re here to clarify those for you.

SECURE YOUR PLACE AT THE ROUNDTABLE

Register for the AI andActionable Insights for Business Leaders Hybrid Roundtable

* Survey Completion is required before attending the session

REGISTER NOW

Who should attend?

  • Business Owners
  • Managing Directors
  • General Managers
  • Risk & Compliance Leaders
  • Technology Decision Makers

If AI sits anywhere on your 2026 roadmap, this session is for you.

Attendance Requirement

To participate in this roundtable, you are required to complete the AI & Your Business Survey after registering.

The survey responses form the foundation of the session insights. Completing it ensures the discussion reflects real market conditions, practical implementation experiences, and meaningful benchmarks for 2026 planning.

AI & Your Business in 2026 Survey

Take the survey → Help shape the agenda
Take the Survey