Downtime: When IT Goes Wrong

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

A week when bugs found by artificial intelligence hit the real world. Websites around the world, including the Australian Signals Directorate's own, went offline as operators rushed to patch two critical flaws in PHP, the language behind WordPress. Fortinet pushed urgent firewall updates, ASD released its Annual Cyber Threat Report, and the privacy regulator reported a jump in very large data breaches.

This week's stories: the PHP vulnerabilities and what to ask your web host (fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35); Fortinet's priority updates for FortiOS, FortiManager and FortiAnalyzer, with full advisories due 10 November; ASD's Annual Cyber Threat Report 2025–26, where the average self-reported cybercrime cost for a medium business rose 45% to $141,300, plus a Melbourne furniture business that nearly lost $118,000 to a fake change of bank details; the OAIC's January to June 2026 breach statistics, with 11 breaches affecting more than a million people, alongside recent incidents at Canva (through a third-party feedback tool), a Sydney schools council and a Sunshine Coast accounting firm; ASD Essentials, the successor to the Essential Eight; and a Microsoft 365 password reset change arriving on 9 November.

Fix this week: MFA types compared. Why SMS codes are the weakest kind of multi-factor authentication, what number matching does, and why passkeys and security keys are what ASD now recommends.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Australian Signals Directorate (cyber.gov.au alerts, Annual Cyber Threat Report 2025–26 and ASD Essentials), PHP Group (php.net), Fortinet, Office of the Australian Information Commissioner, ABC News, SBS News, Cyber Daily, SmartCompany, Microsoft.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Just before 5 am on Friday 7 May 2021, a control room employee at Colonial Pipeline, which carries nearly half the fuel used on the US east coast, found a ransom note on a computer screen. Within about an hour all 5,500 miles of pipeline had been shut down, and within days petrol stations from Atlanta to Washington were running dry. The way in, the company later told the US Senate, was a legacy VPN account that was not meant to be in use and was protected by nothing more than a password. This episode tells the story of the DarkSide ransomware attack, the US$4.4 million ransom, and how the FBI clawed back US$2.3 million of it.

You'll come away understanding why old and unused accounts are among the most dangerous things on your network, and how a quarterly account clean-up closes them; why multi-factor authentication belongs on every way into your business, and why Australia's new ASD Essentials framework now asks for the phishing-resistant kind; why a password reused anywhere is a password leaked everywhere; how attackers sat inside Colonial for nine days, and what simple alerts help you spot that; and why knowing how you would keep trading by hand, with offline backups you have actually restored from, matters as much as any lock on the door. We also cover what Australian law now asks of you if you are ever extorted.

A practical first step: this week, ask whoever manages your IT for a list of every account that can log in to your systems from outside the office, and switch off any that belong to people who have left.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Colonial Pipeline CEO Joseph Blount's testimony to the US Senate Homeland Security Committee; US Department of Justice; CISA and FBI joint advisory AA21-131A; Bloomberg News; Idaho National Laboratory CyOTE case study; Australian Signals Directorate.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In March 2023, Australian lender Latitude Financial announced a cyber attack it first thought had touched about 330,000 people. Eleven days later the count was about 14 million records, including roughly 7.9 million driver licence numbers, many belonging to people who had stopped being customers years earlier. This is the story of how one set of stolen staff login details turned into what was described at the time as the largest known breach of an Australian financial company, why Latitude refused to pay the ransom, and what it cost.

You'll come away understanding why the safest customer data is the data you no longer keep, and how to set a simple retention and deletion schedule; where your business stands under the Privacy Act and the Notifiable Data Breaches scheme, including the A$3 million turnover threshold and the many exceptions to it, plus where the 2024 and 2026 reforms are heading; why every supplier login into your systems needs its own account, multi-factor authentication and an expiry date; why multi-factor authentication on email and remote access is the cheapest insurance you can buy; and how to communicate honestly with customers when the numbers keep changing.

A practical first step: this week, list every place your business stores copies of customer ID documents, and ask whether you still need each one.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Latitude Financial ASX announcements and results; Office of the Australian Information Commissioner; Australian Computer Society Information Age; iTWire; Capital Brief; Service NSW.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

Just before 1 am on 10 March 2021, a fire broke out in a power room at OVHcloud's data centre campus in Strasbourg, France. By morning one building was gone, part of another was destroyed, and an estimated 3.6 million websites were offline. Some customers discovered that their "backups" had been sitting in the same buildings as the servers they were meant to protect.

You'll come away understanding what a data centre actually is and why even a well-run one can burn; why a backup in the same building, or even the same campus, is not really a backup; the 3-2-1 rule (three copies, two different kinds of storage, one off-site, with at least one copy offline or impossible to change); why a backup you have never restored from is only a hope; how to find out where your data physically lives; and why you need to read what your cloud or hosting contract really promises, because the French courts found that the fine print on liability matters a great deal.

A practical first step: ask whoever runs your systems to restore one important file and one whole system from backup this month, and to tell you, in writing, which city each copy of your data lives in.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: OVHcloud incident updates and statements by founder Octave Klaba; the French accident investigation bureau BEA-RI report (May 2022); the Bas-Rhin fire service report as reported by The Register; Netcraft; DatacenterDynamics, Blocks and Files and LeMagIT coverage of the Lille and Douai court rulings; Australian Cyber Security Centre Essential Eight guidance.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On 4 October 2021, a single command during routine maintenance cut Facebook off from its own data centres. Within minutes, Facebook, Instagram, WhatsApp and Messenger disappeared from the internet worldwide for about six hours, and engineers reportedly struggled even to get into the buildings to fix it. For the small businesses that took orders through Instagram and WhatsApp, the shop was simply shut.

You'll come away understanding what DNS and BGP are, in plain English, and why one mistake made a giant vanish; why you should own your customer list, website, domain and email rather than renting your whole business from one platform; why every business needs a back door into its own systems when the front door is broken; why your critical how-to documents and phone numbers should exist offline and on paper; and why even small changes deserve a simple change-control habit.

A practical first step: this week, export your customer contacts from every platform you sell through and store a copy somewhere you control.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Meta Engineering blog (Santosh Janardhan), Cloudflare, The New York Times, Reuters, Thomson Reuters Foundation, Wired.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In April 2022 a routine clean-up script at Sydney-founded software giant Atlassian was handed the wrong list of IDs and run in the wrong mode. Instead of removing one old app, it deleted 883 whole cloud sites belonging to 775 customers, and some of those businesses waited up to 14 days to get their Jira and Confluence back. This episode walks through what happened, why the restore was so slow, and what Atlassian's unusually candid post-incident review teaches every small business that runs on cloud software.

You'll come away understanding why your software provider's backup is not your backup; how to ask each cloud tool two plain questions, "how much could I lose?" and "how long until I'm back?"; why a regular export of your critical data is cheap insurance; why you need a way to reach your staff and customers that doesn't depend on the system that's down; and how "mark it first, delete it later" thinking and simple change control protect your own IT from the same kind of slip.

A practical first step: list the five cloud services your business can't run without, and for each one, find out today whether you can download a full copy of your data.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Atlassian Post-Incident Review (April 2022 outage); Atlassian CTO Sri Viswanath's outage update; The Register; TechTarget; ACS Information Age; Australian Cyber Security Centre (Essential Eight).

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In August 2019 a European subsidiary of Toyota Boshoku, a car components maker in the Toyota Group, followed what it later called fraudulent payment directions and lost an expected four billion yen, about 37 million US dollars. This episode walks through what happened, why fake invoices and "our bank details have changed" emails work so well, and what the latest Australian figures say about payment redirection scams, which cost Australians $166.8 million in 2025.

You'll come away understanding why every change of bank details needs a phone call to a number you already have, why multi-factor authentication on email is the single biggest defence against a hijacked mailbox, how to get alerted when someone quietly adds a forwarding or inbox rule, what SPF, DKIM and DMARC do to stop lookalike and spoofed emails, why two people should approve every payment and every new account, and exactly what to do in the first hour if money has gone: call your bank, report to ReportCyber, and get support from IDCARE.

One practical first step: write a one-line rule for your accounts team this week. No change of bank details is entered until someone has rung the supplier on a number from your own records, not from the email.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Toyota Boshoku Corporation (September 2019 announcement, as reported by BleepingComputer), Automotive News Europe, Australian Signals Directorate (Annual Cyber Threat Reports 2024–25 and 2023–24, and cyber.gov.au guidance), National Anti-Scam Centre Targeting Scams Report 2025 (ACCC), ABC News, Microsoft Learn.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On the Friday before the US Independence Day weekend in 2021, a criminal ransomware operation abused a tool that IT providers use to look after their clients' computers. Through fewer than 60 directly compromised Kaseya customers, many of them managed service providers, ransomware reached up to 1,500 businesses, from New Zealand schools to Sweden's Coop supermarket chain, which had to shut most of its roughly 800 stores. This episode tells the story of the Kaseya VSA attack, from the Dutch volunteers who had already found the flaws to the US$70 million ransom demand, the mysterious universal decryptor and the hacker sentenced in Texas.

You'll come away understanding why the tools and habits of whoever manages your IT matter as much as your own; the questions to ask your IT provider about multi-factor authentication on their remote tools, how fast they patch their own systems and how they keep one client separated from the next; why at least one copy of your backups should sit somewhere your normal management tools cannot reach, and why restores must be tested; how least privilege limits the damage when something does get in; and why a written incident response plan, including how you trade on paper, is what gets you open again in days rather than weeks.

A practical first step: ask your IT provider this week, in writing, whether their remote management system requires multi-factor authentication for every technician, and where your offline backup copy lives.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Kaseya incident updates; Dutch Institute for Vulnerability Disclosure (DIVD); CISA and FBI joint guidance; US Department of Justice; Reuters and BBC News; Truesec.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In October 2022 a criminal walked into Medibank's network using one IT contractor's saved username and password, and walked out with the personal details of about 9.7 million current and former customers, including health claims data. When Medibank refused to pay a ransom, the stolen records were posted on the dark web. This episode follows the attack from the first login to the government sanctions, the regulator's court case and the class actions that are still running today.

You'll come away understanding why multi-factor authentication belongs on every remote access path into your business, not just email; how to give IT contractors and other outsiders only the access they need, with their own accounts; why letting staff save work passwords into a personal browser profile is a hidden risk; why the safest customer data is the data you no longer keep; how the Notifiable Data Breaches scheme works and why it applies to every health service provider regardless of size; and why a one-page incident response plan, with a named person who reads the security alerts, is worth writing this week.

A practical first step: list every way someone can log in to your systems from outside the office (VPN, remote desktop, email, cloud admin portals, your IT provider's tools) and check that each one asks for a second proof of identity.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Office of the Australian Information Commissioner (concise statement in AIC v Medibank Private Limited), Medibank ASX announcements and results, Australian Federal Police, Australian Government ministerial release on the Ermakov cyber sanction, Australian Prudential Regulation Authority and AAP.

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

At about 4:05 in the morning on 8 November 2023, Optus's network fell over. For roughly 12 hours, around 10 million customers and 400,000 businesses lost mobile, internet and landline services: hospital phone lines went down, Melbourne's trains stopped, card terminals stopped taking payments, and more than 2,000 people could not reach Triple Zero. We walk through what happened, what Optus told the Senate about the cause, and what followed: a CEO's resignation, a Senate inquiry, a government review and more than $12 million in penalties.

You'll come away understanding why one internet connection is a single point of failure for your whole business; why a 4G or 5G backup on a different carrier is cheap insurance; how to keep taking payments when the EFTPOS terminal goes quiet; how cloud phone systems and pre-planned call forwarding keep customers getting through; and why writing down what still works when the internet is down is the most useful continuity plan you will ever make.

A practical first step: this week, check which carrier your office internet, your phone system, your EFTPOS terminals and your staff mobiles all use. If the answer is the same company every time, you have found your single point of failure.

Downtime is brought to you by Complete Uptime Solutions, managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.

Sources: Optus submission to the Senate Environment and Communications References Committee; the Committee's report on the Optus network outage; Australian Communications and Media Authority (ACMA); Department of Infrastructure, Transport, Regional Development, Communications and the Arts (Bean review); ABC News; The Conversation.