The scale of these breaches is not the transferable part. The way each one started is: a forgotten access path, a borrowed credential and data kept too long.
Short answer: Forget the millions of records. Three ordinary mistakes caused these breaches, and all three are fully available to a business of ten people: an access path nobody remembered, a credential that belonged to somebody else, and data that was kept long after it was needed. None of the three required a sophisticated attacker.
Key takeaways
The Australian Information Commissioner has commenced civil penalty proceedings in the Federal Court against both Optus and Medibank. Those proceedings contain allegations. They are not findings, neither matter has been determined, and both companies are entitled to defend them. Where this page describes what happened, it describes what the regulator alleges or what the companies themselves have said publicly.
That distinction matters more than it might seem, because the useful lesson does not depend on who ultimately wins.
In September 2022 Optus disclosed a breach affecting millions of current and former customers. The Commissioner alleges that between around October 2019 and September 2022 Optus failed to take reasonable steps to protect the personal information of approximately 9.5 million Australians.
The mechanism, as widely reported and described in subsequent analysis, involved an internet-facing programming interface whose access controls had been rendered ineffective by a coding error. The error was identified and fixed on the main domain, but the same problem on a subdomain was missed. The path stayed open and reachable from the internet.
The small business version. A staging site nobody shut down. A file share opened for a project in 2023 and never closed. A former contractor's account still active. An old plugin on a website nobody maintains. You do not need an API to have a forgotten door, and the smaller the business, the more likely nobody is keeping a list.
What to do about it. Once a year, write down every system that holds client information and every account that can reach it, then close what is not in use. This is a spreadsheet and an afternoon, not a project.
In October 2022 Medibank disclosed a breach affecting 9.7 million current and former customers, with data later published on the dark web. Reporting and subsequent analysis attribute the initial access to compromised third-party credentials rather than to a direct technical exploit of Medibank's own perimeter. The Commissioner alleges that from March 2021 to October 2022 Medibank failed to take reasonable steps to protect the personal information of 9.7 million people.
A class action brought on behalf of affected customers was settled in 2026, reported at $250 million. A settlement is not an admission of liability.
The small business version. This is the one that transfers most directly, because a credential does not care how big you are. A bookkeeper's login shared with the practice. A password reused between your accounting software and a website that was breached three years ago. An offshore assistant's account with no multi-factor authentication. The attacker does not break in. They sign in.
What to do about it. Multi-factor authentication everywhere it is offered, particularly on email, and no shared logins. If you have one password that several people use, that is your Medibank in miniature.
In March 2023 Latitude Financial disclosed a breach affecting roughly 14 million records across Australia and New Zealand. What made it distinctive was age: a large share of the exposed identity documents belonged to people who had applied years earlier, including many who were no longer customers. The Australian and New Zealand privacy regulators opened a joint investigation.
The small business version. The client folder from 2018 still on the shared drive. Scanned licences from an onboarding process you no longer use. Six years of email attachments. Every one of those is a record you gain nothing from holding and lose something from losing.
What to do about it. Decide how long you need identity documents, write it down, and delete the rest. Deleted data cannot be leaked, and this is the only control on the page that is free and permanent.
None of these needed a novel technique. A forgotten path, a borrowed credential and a hoarded archive are failures of housekeeping, and housekeeping does not scale with headcount. A three person practice can accumulate all three inside a year without anyone doing anything wrong on purpose.
There is a fourth pattern worth naming, because it is newer than all of these and appears in none of them. Every one of these breaches was information taken by someone who was not supposed to have it. The routine risk in 2026 is different: information sent out by someone who is supposed to have it, through a tool the business allows, in the course of doing their job. A bookkeeper pasting a client's bank statement into a chat tool has not been hacked and has not broken in. The record still leaves.
That is the gap Prinn works on. It runs on each person's computer and checks a prompt before it is sent. If it finds something sensitive it shows what it found and offers three choices: redact it, stop, or send it as is. The person decides, and it never blocks anyone. Prompt content never leaves the machine, including to us. An owner sees the category, the tool, the date, the device and the choice made, without reading anyone's prompts.
It is reliable on credentials, financial details and identity numbers. Names, home addresses and dates of birth written into ordinary prose are harder, and it is still improving at those. Prinn is not legal advice and does not make you compliant with anything.
Four things, roughly an afternoon in total.
List every system holding client data and close the accounts and paths you no longer use. Turn on multi-factor authentication on email first and then everywhere else. Set a retention period for identity documents and delete what is past it. And write down who to call if something goes wrong, before you need to know.
If you do only one, do multi-factor authentication on email. One in three cybercrime incidents affecting Australian businesses begins there, according to the Australian Signals Directorate.