Karen McDonald, Accountancy Insurance
Most discussions about cyber risk focus on prevention.
Stronger passwords. Multi-factor authentication. Employee training. Security software. All these measures are important, and every accounting firm should take cyber security seriously.
However, recent events across Australia highlight an uncomfortable reality; even businesses with security measures in place can suffer a cyber incident. The conversation is increasingly shifting from how firms prevent attacks to how they recover from them.
For accounting professionals, that distinction matters.
Because when systems go down, client data is compromised, or a fraudulent transaction occurs, the challenge is no longer purely technical. It becomes a business continuity issue, a client relationship issue, and often a regulatory issue.
Recent attacks show accounting firms are targets
For many years, there was a perception that cyber criminals were primarily interested in big business. That perception is becoming increasingly difficult to justify. Recent cyber incidents have impacted accounting firms and accounting service providers in Australia. Publicly reported incidents have involved ransomware attacks, data theft and the exposure of sensitive financial information. Accounting software providers and compliance platforms have also been targeted, demonstrating that threats can emerge throughout the broader accounting ecosystem.
This should not come as a surprise.
Accounting firms routinely hold tax records, payroll data, financial statements, identification documents, trust account information and access to government portals. From a cybercriminal’s perspective, that information is valuable. The question is no longer whether accounting firms are attractive targets to cyber criminals. The evidence suggests they already are.
The financial impact is often larger than expected
When people think about cybercrime, they often focus on stolen data or ransom demands. In reality, the financial consequences can extend much further.
The financial impact of cybercrime is often far greater than many firms realise. Sync Underwriting’s 2025 Cyber Industry Risk Report: Accounting Services found that the average funds transfer fraud loss was $135,000, with the largest reported loss reaching $735,000. Even more concerning, 78% of incidents resulted in no recovery of funds, highlighting how difficult it can be to reverse financial losses once a cybercriminal has succeeded.
For accounting firms, losses are not always limited to stolen money.
A cyber incident can interrupt payroll processing, prevent access to client records, delay lodgements, disrupt billing and place significant pressure on staff managing client expectations. Even relatively short outages can create operational challenges that continue well after systems have been restored.
The direct cost of an incident is often only part of the story. Lost productivity, client disruption and recovery costs can have a significant impact on profitability.
Outsourcing technology doesn’t outsource responsibility
Modern accounting firms rely heavily on third-party technology providers. Cloud accounting software, document management solutions, practice management systems, payroll platforms and managed IT service providers have become an essential part of everyday operations.
While these providers bring significant efficiencies, they can also create an assumption that cyber risk has been transferred elsewhere. In practice, that is not always the case. The 2025 Cyber Industry Risk Report: Accounting Services by Sync Underwriting highlights an important reality for accounting firms: outsourcing technology does not necessarily outsource responsibility. Even when a cyber incident originates with a third-party software provider, cloud platform or managed IT service, firms may still retain obligations relating to privacy compliance, client notification and stakeholder communication. In some circumstances, regulators may regard the accounting firm, rather than the technology provider, as the organisation closest to the affected client and therefore responsible for managing the response.
Recovery planning matters as much as prevention
Every firm hopes it will never experience a cyber incident. But effective risk management involves preparing for the possibility that one may occur.
The firms that recover most successfully are not necessarily those that avoid every threat. More often, they are the firms that have a clear response plan, know who to call and can access specialist support quickly when something goes wrong.
Following a serious cyber incident, businesses may need forensic investigators, privacy lawyers, negotiation specialists, regulatory advisers, public relations consultants and data recovery experts. They may also need assistance with client notifications, regulatory reporting and restoring normal business operations.
Attempting to coordinate those resources during a live incident can be overwhelming. That is why recovery planning has become such an important part of cyber resilience.
Where cyber insurance fits
One of the biggest misconceptions about cyber insurance is that it prevents cyberattacks from occurring. It does not.
Cyber insurance should be viewed as a response and recovery solution, rather than a security solution. Its role is to help businesses manage the consequences of an incident when preventative controls have failed or been circumvented.
For accounting firms, this often means access to coordinated incident response services, including forensic specialists, legal advisers, notification support, public relations professionals and business recovery assistance. It may also provide support for losses arising from business interruption, cybercrime, extortion events and privacy breaches, depending on the policy terms and circumstances.
The value is not simply financial.
It is having experienced specialists available when decisions need to be made quickly, clients need answers, and the priority is getting the business operating normally again.
A changing conversation
Cyber security will always remain essential. But as attacks become more common and cyber risks continue to evolve, accounting firms are recognising that prevention is only one part of the equation.
The real test often comes after an incident occurs.
- How quickly can the business respond?
- How effectively can it communicate with clients?
- How confidently can it meet its regulatory obligations?
- And how quickly can it get back to serving clients?
Those questions are why cyber recovery is becoming just as important as cyber security for accounting firms.
Want an obligation-free quote?
Complete the relevant Cyber Shield quick quote form by clicking one of the links below. Once you have submitted the form, a member of the Professional Risks team will be in touch.
Accountants and Financial Planners, click here.
Bookkeepers/BAS Agents, click here.