Cyber Security Loop – Edition #10
Each month, I share a quick pulse on what’s happening in the world of cybersecurity – framed for law firm leaders and risk stakeholders across Australia. Think of it as your boardroom-ready headline brief: short, sharp, and trusted.
Here’s what’s hot this week — and what you should be thinking about.
🧨 HOT THIS WEEK: 51 Law firms globally have been hit by Ransomware gangs
Since the start of this year, 51 law firms globally have been targeted by ransomware groups. This sadly includes Brydens Lawyers, a prominent Australian law firm. This should be a stark reminder to start reviewing how prepared you are for cyber attacks. An observation from several penetration assessments I've carried out this year is that while most firms' external defences are solid, their internal defence controls leave a lot to be desired. Detecting the use of everyday tools for bad behaviour, a technique favoured by cybercriminals, is often lacking.
If you’re not sure your tech or security teams could spot suspicious lateral movement post-click… this is your reminder to review your detective controls.
—
🔐 Cyber Bytes – 4 Stories Worth Noting
📰 Banking passwords stolen from Australians are being traded online by cyber criminals→ https://www.abc.net.au/news/2025-04-29/australian-bank-customers-passwords-stolen-by-malware-hackers/105196976
📰 Law Society of NSW issues new data handling guidance → Emphasising duty of care around client confidentiality and mandating tighter document sharing practices.
📰 The Fullerton Hotel Sydney → The Fullerton Hotels and Resorts group has confirmed a cyber attack that is impacting its hotel in Sydney. Allegedly 148-gigabytes of data including passports and driver license details were taken in the attack.
📰 Zoom Users Beware → A social engineering campaign is abusing Zoom's remote control feature to take control of victims’ computers and install malware, according to researchers at security firm Trail of Bits.
—
🛠 Tool of the Month
📍 Tool: Have I Been Pwned? 🔗 Link: https://haveibeenpwned.com/ A brilliant free tool to check if your law firm’s email domains or staff credentials have appeared in known data breaches. Set up your domain monitoring — you’ll be instantly alerted if anything suspicious pops up in future dumps.
—
🧠 Tip of the Month
💡 Incident Response: Time-Box Your Internal Escalation
When an unusual alert is raised — endpoint antivirus alert, spoofed email, login anomaly — does your team know how long they have before they're expected to escalate?
Set a simple rule: ⏲️ “If an anomaly can’t be explained in under 10 minutes, escalate to the next layer.”
This drastically reduces ‘sit and see’ behaviour that delays detection and increases breach exposure.
Have you formalised your firm’s escalation clock?
—
📚 Resource of the Month
📍 National Data Breach Statistics Dashboard 🔗 Link: https://www.oaic.gov.au/privacy/notifiable-data-breaches Updated each reporting period by the Office of the Australian Information Commissioner (OAIC) — track trends, causes, and which industries are reporting the most breaches. A great tool for governance committees and legal risk leaders.
Bonus: Check out the interactive charts for legal sector-specific insights.
—
📖 Book I’m Recommending This Month
"The Road Less Stupid" – by Keith J. Cunningham 🧠 Blunt, practical and funny — this isn’t a tech book, but one about thinking clearly in business and avoiding the self-inflicted wounds that kill progress and profit.
Cunningham’s core message? Great operators don’t need more genius ideas — they need fewer dumb decisions.
If you're a law firm principal or CIO navigating growth, compliance, and complexity… this one’s well worth a weekend flip-through.
—
🙋 Have something to add or a question for an upcoming edition? Drop me a message — I’d love to hear what’s top of mind for you in cyber right now.
Until next time, stay secure. — John Reeman
Cyber Strategy | Cyber Defence | Incident Response — for Law Firms