The Five Cyber Threats Actually Hitting Australian SMBs Right Now

Forget nation-state hackers in the movies. The attacks draining money from Australian small businesses are unglamorous, automated and ruthlessly effective. Here are the five we see most — and the practical defence for each.

1. Business Email Compromise (BEC)

An attacker phishes one staff password, quietly reads mailboxes for weeks, then strikes: a doctored invoice with new bank details, sent from a real, trusted email thread. The money leaves, and it's rarely recoverable. BEC consistently tops Australian SMB loss statistics.

• Defence: MFA on every mailbox (non-negotiable), alerts on suspicious sign-ins and inbox rules, and a hard business process: bank-detail changes are ALWAYS verified by phone on a known number.

2. Ransomware

Modern ransomware crews steal your data first, then encrypt it, then threaten to publish — so even good backups don't remove the extortion pressure. Entry is usually a phished credential, an unpatched internet-facing system, or remote access without MFA.

• Defence: patch fast, MFA remote access, run EDR with someone actually watching it, and keep immutable backups you've restore-tested. The Essential Eight exists mostly because of this threat.

3. Invoice & Payment Redirection Fraud

The construction and professional-services version of BEC: attackers impersonate your suppliers (or you, to your customers) and redirect payments. Often neither side realises for weeks, and each blames the other.

• Defence: verification callbacks for any account change, DMARC/SPF/DKIM on your domain so criminals can't spoof your email, and staff who've seen a simulated version before the real one arrives.

4. Credential Stuffing & Password Reuse

Billions of leaked passwords circulate freely. Attackers replay them against Microsoft 365, Xero, MYOB and anything else with a login page. If your team reuses passwords across services, a breach at some random website becomes a breach of your business.

• Defence: MFA everywhere, a password manager for the team, and monitoring for your domain in credential leaks.

5. Supply-Chain & Software Compromise

Your business trusts dozens of vendors — IT tools, plugins, managed service providers. When one of them is breached, attackers inherit that trust. SMBs feel this as: "our website plugin was backdoored", "our IT tool pushed malware", or "our supplier's email was compromised and we paid the fake invoice".

• Defence: know your critical vendors, prefer suppliers who can show their own security posture, restrict what third-party tools can touch, and monitor endpoints so a poisoned update gets caught behaving badly.

The pattern behind all five

Notice what's missing: exotic zero-day exploits. Every one of these threats is defeated or blunted by the same short list — universal MFA, fast patching, monitored endpoints, tested backups, trained staff and verified payment processes. That's not a coincidence; it's why the Essential Eight looks the way it does. Do the boring basics brilliantly and you stop being the easy target these attacks depend on.