The AFP, working with the FBI and WA Police, charged two Western Australian men with a combined 14 offences over the "TeamPCP" campaign, which allegedly planted malicious code in open-source software repositories that developers then unwittingly pulled into their own systems. Authorities estimate the poisoned components reached more than 1,000 organisations worldwide, harvesting over 500,000 credentials and exfiltrating at least 300GB of data, with global remediation costs running into the hundreds of millions of dollars.

One of Australia's largest serviced-apartment chains detected unauthorised database access on 17 August, traced to a vulnerability at a third-party service provider. Exposed records predate June 2025 and primarily include names, email addresses and contact details, with a small number containing dates of birth and no financial data affected; reporting indicated more than 1.5 million records could be involved. Quest notified the OAIC and ACSC and warned guests to watch for phishing.

Australia's corporate regulator cautioned that a quick online search is no longer enough to verify investment opportunities, as scammers use generative AI to build networks of deepfake videos, fake websites, reviews and fabricated news articles that lend bogus schemes false legitimacy. ASIC removed more than 19,400 online scams in FY26 — up 182% on the previous year — and urged consumers to verify licence details independently against its professional registers.

The federal government has released draft 'Tranche 2' Privacy Act reforms that would give Australians the right to have their personal data deleted from large digital platforms — social media, search engines, email, messaging, streaming, gaming and AI services with over $500 million in annual revenue or more than 2.5 million monthly users. A three-week public consultation is underway, with the government hoping to pass the reforms within 12 months.

ASX-listed furniture retailer Nick Scali ($1.4bn market cap, 132 stores) disclosed a security incident on 14 August and took several IT systems offline, leaving staff to process orders manually while deliveries were delayed.