10th March 2026 Cyber Update: WA Government Audit Reveals M365 Failures Led to Data Breach and $71k Theft

Cyber News Centre's cyber update for 10th March 2026: The Western Australian government has been hit by significant security failures, with a state audit revealing that poorly configured Microsoft 365 controls led directly to a data breach involving children's information and a separate $71,000 invoice fraud.

The Western Australian Office of the Auditor General (OAG) is a statutory body responsible for auditing the state's public sector. It provides independent information and assurance to Parliament on the financial integrity and performance of state and local government entities, ensuring accountability and transparency in the use of public resources.

The Update and Why It Matters

Update: A damning report from Western Australia's Office of the Auditor General, released March 6, has exposed systemic failures in Microsoft 365 security across seven unnamed state government entities. The audit, which assessed over 160 security settings per agency, uncovered two major incidents directly caused by these weaknesses. In one case, sensitive personal data of 32 individuals, including minors, was leaked after an entity shared it with a third-party provider whose Dropbox account was subsequently compromised.

The agency lacked any data loss prevention (DLP) controls to detect or contain the breach. In a separate incident, a senior officer's M365 account was compromised via a phishing attack that exploited weak multifactor authentication (MFA). The attacker registered their own device, studied the officer's emails for weeks, and successfully orchestrated a business email compromise (BEC) attack, sending fraudulent invoices that resulted in a $71,000 theft. The audit found that none of the seven entities had implemented DLP broadly, all allowed data storage on unmanaged services like Dropbox and Google Drive, and all relied on weak, phishable MFA methods like SMS codes, which were responsible for 58% of Australian government security incidents in 2024-25.

Why it Matters: This audit provides a concrete link between baseline security negligence and significant real-world harm, including financial loss and the exposure of children's data. The findings demonstrate that even with established policies, a failure to implement and monitor technical controls renders government agencies highly vulnerable.

The report draws a direct parallel to the 2022 Medibank breach, which also originated from a compromised personal device, highlighting a persistent, unaddressed attack vector across Australian institutions. For citizens, it confirms that sensitive data held by the government is not being adequately protected, eroding public trust. For other government agencies and businesses, it serves as a stark warning that reliance on default or poorly configured cloud security settings is an invitation for attack. The fact that one entity has still not remediated the controls that led to a $71,000 loss underscores a critical gap between identifying and fixing fundamental security flaws, leaving the door open for repeat incidents.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.