MELBOURNE, September 11 — Twenty employees. That is the size of Macquarrie Corporation, the Port Melbourne engineering firm that found itself listed on the Storm ransomware group’s leak site on September 1, according to Cyber Daily. The company provides diesel engine and machinery management services across Australia and New Zealand.
Storm set a September 16 publication deadline — the standard pressure tactic used before stolen data is released publicly. The entry point was not inside Macquarrie’s own network.
“Macquarrie Corporation is aware of a cyber security incident involving one of its external technology providers, resulting in unauthorised access to certain systems used by the business,” a company spokesperson told Cyber Daily. The company said it acted immediately: “When the incident was identified, we immediately secured the affected systems, engaged independent cyber security specialists, and commenced work to restore operations through alternative arrangements independent of the affected provider.” Data had already reached the dark web by then.
Storm published an employee passport scan, a death certificate, company correspondence, customer data, and credit listings as proof of the breach. The group does not disclose the total volume of data taken but routinely publishes samples to establish credibility with victims.
Macquarrie confirmed it is notifying those affected. “With the assistance of our external legal and cyber security advisers, we have reviewed the material currently known to be involved and are in the process of notifying those whose information has been identified as affected,” the spokesperson said. “We are committed to providing appropriate guidance and support.”
A pattern of third-party compromise
Storm only emerged in August 2026 but has listed 49 alleged victims since it began — more than one per day, according to Cyber Daily. Most of its identified Australian targets have been in the automotive and farm machinery dealer sectors. Sharp Motor Group confirmed in late August that it had also been compromised through a third-party IT provider.
Few of Storm’s other victims have commented publicly, making it difficult to determine how consistently the group uses this attack vector. Macquarrie’s profile — a small business reliant on external technology, operating in an industrial sector — is common across the Australian SME market.
Joerg Schmitz, Aon’s cyber risk quantification and analytics leader for APAC, said in Aon’s 2025 Cyber Risk Report: “Organisations must start treating their vendors as part of their own attack surface. The most lucrative attacks are those that can be scaled across multiple targets through a single compromised supplier. This is a wake-up call for Australian businesses to reassess how they manage third-party risk.” Broker Gallagher has flagged the same issue directly to clients: “If your suppliers or technology partners are exposed, so is your business.
In an interconnected environment, their security standards matter just as much as your own.”
Coverage gaps and regulatory pressure
Some cyber policies expressly include third-party networks within the definition of the insured’s computer system; others do not, and coverage gaps arise where policy language does not clearly extend to outsourced or off-premises infrastructure, a distinction documented in MinterEllison’s Perspectives on Cyber Risk report. Verizon’s 2026 Data Breach Investigations Report — covering more than 22,000 confirmed breaches across 145 countries — found third-party involvement now accounts for 48% of all breaches, a 60% jump on the prior year’s 30%.
The Australian Signals Directorate’s Australian Cyber Security Centre responded to over 1,200 cyber security incidents in FY2024-25, an 11% increase year on year, and handled 138 ransomware incidents, 39% of which the ACSC itself identified before the affected organisation was aware. The Office of the Australian Information Commissioner recorded 1,205 data breach notifications in the 2025 calendar year — the highest annual total since mandatory reporting commenced in 2018 and an 8% increase on 2024.
Under the Privacy Act 1988 and the Notifiable Data Breaches scheme, notification obligations sit with the data controller regardless of where a breach originated. A mandatory ransomware reporting regime, which commenced on May 30, 2025, under the Cyber Security Act 2024, now also applies to businesses with annual turnovers exceeding $3 million, with non-compliance carrying a civil penalty of up to $19,800.
The February 2026 youX incident illustrated how quickly vendor exposure cascades: a single compromised platform generated notification obligations across close to 800 broker organisations and more than 90 lenders. For Macquarrie, the immediate deadline is September 16.
What Storm does with the data it holds — and whether the company’s notification process reaches everyone affected before that date — will determine the next phase of this incident.
