25th July 2025 Cyber Update: NSW Accounting Firm Hit by INC Ransom Attack and US Cleaning Company Exposes 65,000 in Ransomware Breach

Update: The INC Ransom group listed Terry Ringland Chartered Accountants on their dark web leak site, claiming responsibility for a cyberattack against the NSW-based accounting firm. The ransomware group, known for spear phishing tactics and double-extortion techniques, has disrupted the firm's accounting, tax preparation, bookkeeping, and payroll services.

INC Ransom typically encrypts victim data while threatening to publish stolen information online, though no specific ransom amount or payment deadline has been disclosed for this incident. The attack affects a practice that has served Sydney's eastern suburbs for over two decades, potentially compromising sensitive financial data of local businesses and individual clients.

Why it Matters: This attack highlights the growing vulnerability of small-to-medium professional services firms to sophisticated ransomware operations, particularly those handling sensitive financial data. INC Ransom has claimed 375 victims since August 2023 and maintains significant activity in the Australian region, with previous targets including Expert Data Cabling in March 2025 and recent attacks on New Zealand businesses and Tonga's Ministry of Health.

For accounting firms like Terry Ringland, ransomware attacks create cascading impacts affecting not only internal operations but also client tax obligations, payroll processing, and financial reporting deadlines. The incident demonstrates how cybercriminals increasingly target professional services as high-value targets due to their access to extensive client financial records, business intelligence, and personal information that can be leveraged for both immediate ransom demands and long-term identity theft or corporate espionage.

Update: On January 17, 2025, Prestige Maintenance USA detected unusual activity in its digital infrastructure and immediately launched a comprehensive cybersecurity investigation with external experts. The investigation concluded recently, confirming that attackers had gained unauthorized access to sensitive files containing personal information of 65,452 individuals, including names, Social Security numbers, and other personally identifiable information.

The Medusa ransomware gang claimed responsibility for the attack and demanded $1.2 million in ransom. Prestige has reported the incident to federal law enforcement and began mailing breach notification letters to affected individuals on July 22, 2025, offering 12 months of free identity theft protection through IDX with enrollment available until October 22, 2025.

Why it Matters: This attack represents the ninth-largest ransomware incident in the United States in 2025 and highlights the growing threat to service sector companies that handle sensitive employee and customer data. The Medusa ransomware group has claimed responsibility for 132 confirmed attacks compromising over 3.1 million records, with this incident marking their second-largest attack of 2025.

The six-month delay between the initial breach and public notification raises concerns about detection capabilities and response protocols in mid-sized service companies. For the 65,452 affected individuals, the compromise of Social Security numbers creates long-term identity theft risks that extend far beyond the immediate incident, while the company's Fortune 500 client base suggests potential supply chain implications for major corporations relying on Prestige's services.