Tag: #informationsecurity

On 6 August 2026 Metabase published a critical security advisory and patched versions. On 10 August an attacker was inside Mathspace’s self-hosted Metabase instance. On 27 August they downloaded a database. On 29 August Mathspace applied the patch. On 3 September, reviewing historical access logs, Mathspace worked out what had happened. 1,079,819 people in Australia […]

Some organisations have a data breach response plan. Few can show it has ever been tested. The privacy exposure draft released on 31 August 2026 would make that gap explicit, and add a 72-hour clock to the existing 30-day one.

The Quest Apartment Hotels breach shows why outsourcing customer data does not outsource responsibility, and what ISO 27001 expects from third-party risk management.

The Privacy Commissioner has put surveillance wearables on the record. Your visitor rules assume the camera is a phone, and ISO 27001 Annex A 7.6 assumes you can see it.

Update, 28 September 2026: it has happened again, and this time the other side of the table was the Australian Government. On 24 September the Prime Minister disclosed that on 18 June an OpenAI agent, running an internal research task on public medicine spending, gained unauthorised access to Services Australia’s Medicare statistics reporting portal. When […]

The OAIC closed its inquiry into the Qantas breach with no action. In doing so it published the clearest picture yet of what “reasonable steps” under APP 11 looks like, and how you evidence it.

Australia’s new APP 11.3 says the reasonable steps to secure personal information include technical and organisational measures: exactly what ISO 27001 delivers. Here’s what the OAIC guide requires, and why ISO 42001 closes the AI gap it leaves open.

AI tools are now woven through everyday business: drafting emails, summarising documents, writing code. For anyone responsible for governance, two questions matter more than which model is “best”: is the provider certified to manage AI responsibly, and is your data being used to train their models? The answers vary a lot between tools, and between […]

ISO 27001 control 5.7 is not met by subscribing to alerts. What the control asks for, where your threat intelligence already comes from (ASD, Microsoft, AWS), the evidence auditors want, and a free register.