A Queensland accounting and business advisory firm is still investigating a cyber incident after the LockBit ransomware group listed it on its leak site, with a countdown that ran to 25 October. Poole Group, a Sunshine Coast firm founded in 1980, has confirmed it is responding to an incident affecting part of its IT environment, but the published reports do not confirm that data was stolen, encrypted or published, and they disclose neither what data was allegedly taken nor any ransom amount. That distinction matters: a leak-site listing is a claim, not proof of a breach.

What the firm has confirmed

The firm said that once the incident was detected, it immediately implemented containment measures and engaged external cyber security specialists. It has notified the Office of the Australian Information Commissioner, the Australian Cyber Security Centre and the Australian Taxation Office, and says it continues to work closely with those agencies. It also said it would contact individuals directly if it determines that any individuals have been affected. The investigation, in the firm's own words, remains ongoing, including assessing the nature and scope of the incident.

Why small firms are in the firing line

Accounting firms hold exactly the material criminals want to threaten: client financial records, tax details and personal information handled on clients' behalf. That makes even an unproven listing disruptive, because clients, staff and regulators must wait for facts while a countdown creates pressure. No patch or product fix is named in these reports, so this story carries no update instruction. The useful lesson is procedural: contain quickly, bring in specialists, notify the relevant authorities, and tell affected people directly once the facts are known, rather than treating a gang's claim as confirmed or dismissing it without investigation.

Source: Cyber Daily