Cyberattacks aren’t just a headline problem for multinationals. They’re a day-to-day reality for Australian businesses of every size – especially small to medium-sized enterprises (SMEs). And ransomware remains one of the most dangerous and disruptive forms of attack.
Ransomware works by locking up critical systems and threatening to publish or destroy data unless a payment is made. And these attacks are on the rise. The 2025 Bitdefender Threat Debrief disclosed an alarming 126% increase in claimed ransomware victims year-over-year. On top of that, Australia was identified as one of the top 10 countries affected.
The latest victim? A respected mid-sized accounting firm in Victoria.
Inside the MKA Accountants ransomware breach
In mid-May, MKA Accountants confirmed it had been hit by a ransomware attack. According to Cyber Daily, a known ransomware group called Qilin released more than 185GB of internal data, including insurance documents, financials, and sensitive client files. The incident has since become a stark example of the kinds of challenges many mid-sized firms now face — not due to negligence, but because cybercriminals are becoming more strategic, better resourced, and globally coordinated.
MKA Accountants reported the incident to authorities and informed affected clients. But the damage has been done. Once data is leaked, it’s permanent. The breach is a stark reminder of how quickly an incident can move from silent infiltration to public crisis.
Why every Australian business should take note
MKA Accountants is not a global enterprise. They’re not on the ASX. They’re a mid-sized professional services firm, much like thousands of others across Australia.
Cybercriminals aren’t just chasing million-dollar ransoms. They’re increasingly targeting firms like MKA Accountants — trusted local providers who hold valuable client data, but may not have the enterprise-level defences large corporations rely on. And according to Cyber Daily’s exclusive report, this attack was part of a broader strategy by international threat actors who are increasingly turning their focus to Australia’s mid-market.
The consequences are more than technical. A ransomware attack can:
- Force downtime that costs thousands in lost revenue
- Damage client relationships and trust
- Trigger regulatory investigations and fines
- Compromise insurance coverage – or void it
- Take weeks or months to fully recover from
This is not just an IT issue. It’s a business risk with real operational, financial, and reputational stakes. And for many SMEs, recovery is far from guaranteed.
How to prepare, protect, and respond to a ransomware attack
While you can’t always stop an attempted attack, you can control how prepared your business is.
Here’s where to start:
- Educate your team: Most breaches start with a single click. Ongoing phishing simulations and security awareness training are essential.
- Monitor for leaks: Dark web monitoring tools can alert you if your data has been compromised – giving you a head start in responding.
- Harden your defences: Proactive vulnerability scanning, patch management, and endpoint protection reduce entry points.
- Have a plan: A business continuity and disaster recovery plan (BCDR) ensures a cyber incident disrupts as little as possible – and that you’re back on your feet fast.
- Review your MSP before the next breach and ensure they have a managed security, business continuity and disaster recovery options for your size of business.
Cyber resilience isn’t built after the fact. It’s built before something goes wrong.
Let’s review your risks now – and make sure you’re covered before it counts. Get in touch with our expert team today.
