Accounting, finance record spate of data breaches: OAIC figures

The accounting and financial industries feature in the top-three industry sectors to report data breaches, as the first quarterly statistics come through following new data laws.

The Office of the Australian Information Commissioner (OAIC) has published its first full quarterly statistical information about notifications received under the Notifiable Data Breaches (NDB) scheme, since it commenced on 22 February 2018.

Between 1 April and 30 June 2018, the finance, legal, accounting and management services industries accounted for a combined 56 out of 242 notifications of data breaches, just below the health service sector.
 
Of those breaches, 29 were due to malicious or criminal attack, 24 due to human error, and three owing to system faults.

Speaking to Accountants Daily, Julian Plummer, managing director of Kamino Cyber Security and Midwinter Financial Services, said the numbers showed the relative attractiveness of accountants as targets for data breaches.

“Accountants have a huge amount of data for their large numbers of clients, so attacking an accountant gives the hacker access to a larger scale of information as opposed to attack[ing] an individual person,” said Mr Plummer.
“The other side is that accountants are generally underprepared when it comes to information security and in large part this can be attributed to not fully understanding their obligations under the new laws.

“What was interesting is the high amount of human errors that led to data breaches – this leads me to believe that accounting practices that suffered from a data breach had poor levels of security hygiene and lacked basic staff training. Policies for sending out personally identifiable information should be a part of the information security policy, and this is a basic thing to get right.”

Further, Mr Plummer believes with the rise of accounting firms picking and choosing different applications for different processes, more breaches will be likely to be reported before the industry starts to take the issue more seriously.
“Things are only going to get worse before they get better,” said Mr Plummer.
“Consider the increasing number of accountants that are currently “picking their own stack” of applications with the intention of integrating them via API. This is going to only lead to more data being produced, dramatically increas[ing] the attack surface area of the practice.

“A mistake we see quite often is an accountant thinking that installing a virus monitoring tool will take care of everything. It won’t,” he added.

“Instead they should be investing in an information security policy, a layered security approach and the training of staff to increase awareness.”

The Tax Practitioners Board (TPB) has warned the industry that failure to comply with the NDB scheme could result in possible sanctions from the body, on top of severe penalties issued by the OAIC.

Source: Originally published by  accountantsdaily
jotham.lian@momentummedia.com.au