Cybersecurity essentials for Australian accounting practices in 2026

Accounting firms hold exactly the data criminals want. A practical 2026 guide to the threats, the Privacy Act and AML/CTF obligations you are under, and the handful of controls that stop most breaches.

Accounting practices hold exactly the data criminals want: tax file numbers, bank details, identity documents, financial records for hundreds of clients, all in one place. That makes a firm a high-value target, and it means cybersecurity is no longer an IT afterthought — it is a client-trust and compliance issue that sits with the partners. Here is what actually matters for an Australian practice in 2026.

The threats that hit firms

Business email compromise. The most common and costly attack. A scammer gets into (or convincingly impersonates) an email account and sends a fake invoice or a "our bank details have changed" message. The money is gone before anyone notices.
Phishing. The way most breaches start — a staff member clicks a link and hands over a password.
Ransomware. Your files encrypted and held hostage, often with the threat of leaking client data if you do not pay.

The rules you are already under

Even without a single "cyber law" for accountants, several obligations already apply:

The Privacy Act. Under the Australian Privacy Principles you must take reasonable steps to protect the personal information you hold. "Reasonable" rises as the sensitivity of the data rises — and client financial data is about as sensitive as it gets.
The Notifiable Data Breaches scheme. If an eligible breach is likely to cause serious harm, you must notify both the OAIC and the affected individuals. Recent reforms have strengthened the regime and lifted the penalties for getting it wrong.
ATO access requires multi-factor authentication. Logging in to ATO online services for agents is already tied to strong, multi-factor identity. Treat that as the baseline standard for everything else you use, not the exception.

A useful benchmark to work against is the Australian Signals Directorate's Essential Eight — the government's baseline set of mitigations. You do not need to implement it to a formal maturity level to benefit from using it as a checklist.

New for 2026: the AML/CTF expansion

From 1 July 2026, the expanded anti-money-laundering and counter-terrorism-financing regime — the "tranche two" reforms — brings a range of professional services into scope, including a number of services accountants provide. For affected firms this adds obligations around verifying client identity, keeping records and reporting. If you offer services that may be captured, the time to understand your position and prepare is now, not after commencement. Good identity-verification and record-keeping practice overlaps heavily with good security practice, so the two efforts reinforce each other.

The practical checklist

Most breaches are stopped by a handful of unglamorous controls done consistently:

Multi-factor authentication everywhere. Email, your practice software, your ledgers, cloud storage — not just the ATO. This single control blocks the majority of account-takeover attacks.
A password manager. So staff use long, unique passwords they do not have to remember or reuse.
Keep everything updated. Most successful attacks exploit a known hole that a patch had already fixed.
Least privilege and prompt offboarding. People get access to what they need, and access is removed the day someone leaves.
Tested, offline backups. A backup you have never restored from is a hope, not a plan. Keep a copy that ransomware cannot reach, and test it.
Train the team on phishing and BEC. Your people are the control that catches what the software misses.
Verify bank-detail changes by phone. Any request to change payment details gets a call back on a number you already hold — never a number in the email itself. This one habit stops most invoice fraud.
Stop emailing sensitive documents. Use a secure client portal for anything containing financial or identity data, so it is not sitting in inboxes waiting to be stolen.
Write an incident response plan. One page: who to call, how to contain it, and the OAIC notification steps. Decide this before you need it, not during.
Consider cyber insurance and check your vendors. Your security is only as strong as the suppliers you connect to your data.

Security is client service

Clients trust you with the most sensitive information they have. Protecting it is not a cost centre or a compliance chore — it is part of the professional relationship, and increasingly part of how clients choose a firm. The practices that treat security as a visible strength, rather than a quiet risk, are the ones clients will keep recommending.