The short answer
Most recent incidents did not need clever hacking. They used phished staff, stolen tokens from connected apps, and unpatched software. The checks that matter most are two-factor sign-in on every admin and hosting account, fast patching, an inventory of connected apps and tokens, tested backups, and a plan for notifying customers. Australia’s Essential Eight gives a good structure for the rest.
- Phishing-resistant sign-in (passkeys or app-based two-factor) on every admin account.
- An inventory of every app connected to your CRM, email and storage.
- Patch critical and exploited flaws within 48 hours.
- Know your Notifiable Data Breaches obligations before you need them.
Why these twelve
The Salesloft Drift incident in August 2025 showed how stolen OAuth tokens for a connected chat app could be used to pull data from many companies’ Salesforce instances. The Qantas breach in 2025 began with a vishing call to a call centre. Neither required breaking the main system’s code. Sources: Google Threat Intelligence on the Salesloft Drift incident, iTnews on the OAIC and the Qantas breach
Accounts and access
1. Two-factor sign-in, ideally passkeys, on domain registrar, DNS, hosting, CMS, email and CRM. 2. No shared logins; each person has their own account. 3. Remove leavers the same day. 4. Admin rights only for people who need them.
Software and patching
5. A named owner for website updates. 6. Critical patches applied within 48 hours. 7. Automated vulnerability alerts on the code repository. 8. Plugins or dependencies reviewed every quarter, unused ones removed. Sources: CISA Known Exploited Vulnerabilities
Connected apps and data
9. A list of every third-party app connected to email, CRM and storage, with the permissions each has. 10. Tokens revoked for anything unused. 11. Backups that are tested by restoring them, kept somewhere attackers cannot delete.
Response
12. A one-page plan: who to call, how to lock accounts, how to assess whether personal information is involved, and how to notify the OAIC and customers if required. Sources: OAIC Notifiable Data Breaches
Use the Essential Eight as the frame
The Australian Cyber Security Centre’s Essential Eight covers patching, multi-factor authentication, admin privileges, backups and application control. Maturity Level One is a sensible first target for most small businesses. Sources: ACSC Essential Eight
Questions people ask
What is the single most important control?
Phishing-resistant multi-factor sign-in on email, hosting and admin accounts.
Do small businesses need to report breaches?
Businesses covered by the Privacy Act must report eligible data breaches. Some small businesses are exempt; check with the OAIC guidance.
How often should we test backups?
At least quarterly, by restoring to a test environment.
No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.
