Macquarrie Corporation has 20 employees and a workshop in Port Melbourne. On September 1 it turned up on the leak site of the Storm ransomware group, Cyber Daily reported. The company manages diesel engines and machinery for customers across Australia and New Zealand.
Storm gave it until September 16 before publishing what it took. That is the usual squeeze: pay or watch the files go public. And the way in was not Macquarrie’s own network.
“Macquarrie Corporation is aware of a cyber security incident involving one of its external technology providers, resulting in unauthorised access to certain systems used by the business,” a spokesperson told Cyber Daily. The company said it moved fast. “When the incident was identified, we immediately secured the affected systems, engaged independent cyber security specialists, and commenced work to restore operations through alternative arrangements independent of the affected provider.”
By then some data was already on the dark web. As proof, Storm posted a scan of an employee’s passport, a death certificate, company correspondence, customer data and credit listings. The group does not say how much it actually holds, but it habitually posts samples to show victims it is serious.
Macquarrie says it is writing to the people affected. “With the assistance of our external legal and cyber security advisers, we have reviewed the material currently known to be involved and are in the process of notifying those whose information has been identified as affected. We are committed to providing appropriate guidance and support,” the spokesperson said. The company is also in contact with the Australian Cyber Security Centre and the Office of the Australian Information Commissioner.
Storm and the supplier route
Storm only surfaced in August 2026, yet it has already listed 49 alleged victims, more than one a day, according to Cyber Daily. Its Australian targets have mostly been car dealers and farm machinery dealers.
Sharp Motor Group said in late August that it too had been hit through a third-party IT provider. “Sharp Motor Group is aware that our third-party IT provider has been involved in a cyber incident,” a spokesperson told Cyber Daily. Most of Storm’s other victims have said nothing, so it is hard to tell how often the group gets in this way.
Joerg Schmitz, Aon’s cyber risk quantification and analytics leader for APAC, put the issue bluntly in Aon’s 2025 Cyber Risk Report. “Organisations must start treating their vendors as part of their own attack surface. The most lucrative attacks are those that can be scaled across multiple targets through a single compromised supplier. This is a wake-up call for Australian businesses to reassess how they manage third-party risk,” he said. Broker Gallagher has told clients much the same: “If your suppliers or technology partners are exposed, so is your business. In an interconnected environment, their security standards matter just as much as your own.”
What the figures show
Verizon’s 2026 Data Breach Investigations Report, which covers more than 22,000 confirmed breaches in 145 countries, found third parties involved in 48% of them. A year earlier the share was 30%, so it has risen by 60%.
Closer to home, the Australian Signals Directorate’s Australian Cyber Security Centre handled over 1,200 incidents in FY2024-25, up 11%. Of the 138 that were ransomware, the centre itself spotted 39% before the victim knew. The Office of the Australian Information Commissioner logged 1,205 data breach notifications in calendar 2025, an 8% rise on 2024 and the most in a year since mandatory reporting began in 2018.
Insurance is a sore point. Some cyber policies count third-party networks as part of the insured’s computer system, and others do not. MinterEllison’s Perspectives on Cyber Risk report documents gaps where the wording fails to reach outsourced or off-premises infrastructure.
The legal duty does not move with the breach. Under the Privacy Act 1988 and the Notifiable Data Breaches scheme, notification falls to the data controller wherever the intrusion began. A ransomware reporting regime under the Cyber Security Act 2024 took effect on May 30, 2025 and covers businesses with annual turnover above $3 million. Failing to comply carries a civil penalty of up to $19,800.
The youX incident in February 2026 showed how far one supplier can spread the damage: a single compromised platform triggered notification obligations for close to 800 broker organisations and more than 90 lenders.
