Safety

Cybercriminals are attacking schools

Cybercriminals are attacking schools, but it’s not the students that are the victims!

Many schools in Western Australia were hacked last month by cybercriminals and parents were the ultimate target.  Schools warned parents that bank details and signatures might have been stolen.  One school was under a four-day cyber-attack which started on 11 June 2019.

A message from one Principal expressed his “deep regret” for the cyber breach which he said was “highly sophisticated”.[1]

The message from the principle, a Mr Rob Crothers stated:

“Parents who may have provided information relating to accounts from which to take fee payments or to make payments to the school could have been compromised if they were sent by email format. Certainly, anyone who has sent information to the college by email, particularly of a financial nature, would be susceptible to the attack having taken place”.

Cyber Attack ‘Shocks Parents’

One parent cancelled their credit card, and parents have voiced their concern over the attacks.  The schools are in reactive mode at present while the attacks are investigated.

One school is looking into improving its process to mitigate future attacks.

Tips

You should always adopt a proactive approach to Cyber-attacks.

This can include ensuring both staff and parents have some Cyber awareness training so that they know what to look out for and what they should and shouldn’t do on the internet.

Also, with a proactive approach, you will know what to do in case of a cyber-attack and advise accordingly.

Don’t wait for the event to happen; be proactive now.

[1] https://www.abc.net.au/news/2019-06-20/nagle-catholic-school-parents-targeted-in-cyber-attack/11227802


Book a Strategy call to discuss what you can do!

Category: Safety

Tax rulings may mean you owe Thousands!

 

Stay Informed About Recent Tax Rulings

Recent tax rulings could lead to unexpected financial obligations, potentially costing you thousands of dollars. These rulings often arise from changes in tax laws, audits, or re-evaluations of past filings. If you do not understand how these rulings impact your specific situation, you may face significant penalties or back taxes. Take proactive steps by staying informed and seeking professional advice to avoid these surprises. By addressing potential issues early, you reduce the financial impact and ensure compliance with the latest regulations.

The Australian Tax Office’s Note on Superannuation Contributions

On 12 March 2019, the Australian Taxation Office (ATO) clarified its stance on whether annual leave loading attracts Superannuation Guarantee contributions. The ATO based this decision on whether the leave loading qualifies as ordinary time earnings (OTE). Employers must understand this distinction because it directly impacts their required superannuation contributions for employees. If the ATO considers leave loading to be OTE, employers would need to include it in their superannuation guarantee obligations, potentially increasing contributions and altering employee benefits.

Understanding the Common Misconception About Ordinary Time Earnings
Many believe that annual leave loading does not qualify as OTE because it was initially intended to compensate employees for the lost opportunity to work overtime during their leave. This interpretation leads some to assume they are exempt from making additional contributions. However, this assumption may not apply to every case, and the terms of employment, as well as the nature of the leave loading, may create variations in the ruling.

Avoid relying on a blanket ruling. Instead, take the time to understand your specific situation under current tax laws. By consulting with our Subject Matter Experts, you can navigate these complex rulings with confidence. We ensure you remain fully compliant with superannuation regulations and avoid financial penalties. Seeking expert advice protects both employers and employees from unforeseen liabilities and secures their financial well-being.


Book a Strategy Call Today

Category: Safety Tags:

Hospitality Industry has 2nd Highest number of Cyber breaches

The Hospitality industry is reported to have the second-highest number of Cybersecurity breaches[1]. How are they still being breached even with expensive technical point solutions?

Several reports indicate the hospitality industry is under attack, as are other sectors, and breaches are commonplace[2].  In 2017 Sabre Hospitality was a victim of a security breach which impacted its SynXis hotel reservation system which allowed unauthorised access to payment card information[3].

However, surely with advanced technology available today, you can mitigate the risk, right?  Well yes and no, technology is only part of the solution, often overlooked is the human factor. This can influence the attack vector to gain access and eventually compromise sensitive information within your organisation.

There are some excellent technical products in the market, and yet large corporates are still being breached even with these products being deployed, through no fault of the vendor providing the solution in the first place.

You cannot mitigate every Cyber risk in an organisation, and if anyone tells you, they can, then you should look elsewhere for advice.

So what can I do about it?

The solution should be tailored for your organisation as not one glove fits all!

Here are some, but not limited to, steps you might want to consider:

  • Conduct a Cyber Maturity Review to ascertain what areas may require further enhancements
  • Conduct a Cyber Risk Assessment to identify the critical assets you need to protect and how.
  • Train all staff in Cyber awareness, onboarding and refresher training can help and is cost-effective.
  • Train selected staff to attend professional Cyber training

So don’t just rely on a technical solution.

[1] PwC’s Hotels Outlook report 2018 to 2022

[2] Insights Study into Cyber threats in hospitality

[3] https://www.phocuswire.com/Sabre-updates-on-unauthorized-access-confirms-payment-details-hacked


Book a Strategy Call to discuss your first steps

Category: Cybersecurity, Safety

Abusive Customers

Under workplace safety legislation all businesses have a legal duty to provide a safe workplace, so they need to be thoroughly prepared for the possibility of abusive customers, violent customers and armed hold ups.

Most managers are aware that they must protect all staff members from workplace bullying, sexual harassment and violence between staff members but there is also a more urgent need to protect staff from customers!

Bar staff report that customer abuses is endemic and increasing.  Industries that must deal with the public are being subjected to all types of abuse.  Ranging from verbal insults and threats to all-out physical assault with weapons and in some cases sexual assault.

Managers need to be trained in how to defuse the situation and to back their staff.  The customer is not always right.  Managers need to make sure that their staff are safe and that they have the right to refuse service to customers who are abusive or making threats to them.

Conflict resolution is not just for internal use but needs to cover external influences.  The purpose of General Evacuation Training is to cover what to do in all types of emergencies.  Does your General Evacuation Training cover what to do in the event of armed hold up; active shooter or an aggressive person? 

What training does your staff need?  Are you supporting them? What behaviour will you not tolerate in your customers?  See how polite this manager was he orders his customers out of his restaurant.



Book a Strategy session to discuss your training needs

Category: Safety

Hackers are checking into hotel systems

It’s official, ‘hackers are checking into hotel Systems’, have you been Phished[1]?

Criminals are after your data so they can steal credentials and use them to get money, and this time it seems the gang associated with these attacks are the same as the ones who took USD 1Billlion from banks.

So how do they do it?

The first step is not hacking a computer but socially engineering[2] a person![3]

Step 1 – A phone call is received at a hotel reservation desk by a pretend hotel guest to discuss a problem confirming a reservation. They say they have a question, and can they help?

Step 2 – The caller says they have information about the reservation and would like an email to send to the reservation desk so the hotel can help them.

Step 3 – The caller sends an email to the reservation desk with an attachment.  The hotel opens the attachment, which has malicious software called ‘Malware’.  The malware is designed to find the sensitive information the caller wants and downloads more Malware tools to assist in its search.

Step 4 – The hotel system is now compromised and send all the information that the caller needed to them and the malware can stay on the system if they want to download future reservation information.

While this story was about a hotel chain, the same approach can be used for many businesses alike, and this is called a ‘Phishing Scam’.  There are different types of Phishing scams, depending on the intended victim.

Help me protect myself from a Phishing Scam!

All staff should be trained on how to spot a potential scam, for example, not posting information on social media such as vacation plans, phone numbers, your address.

[1] The fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.

“an email that is likely a phishing scam”

[2](In the context of information security) the use of deception to manipulate individuals into divulging confidential or personal information that may be used for fraudulent purposes.

[3] https://whatismyipaddress.com/hacking-hotels


Book a Strategy Call Today

Category: Safety Tags: ,

The UK might fine Marriot Hotel 99 Million Pounds for data breach

The UK might fine Marriot Hotel £99Million for Data Breach!

Following on from our previous article, it looks like countries are submitting claims against the Marriot Hotel Chain according to the Register UK.[1]

The UK’s Information Commissioners office is the first to file a claim for fining the hotel chain.

If other countries follow suit, it could be a very costly affair, not to mention the reputational damage to the hotel chain.

The Chief Executive of Marriot International stated:

“We deeply regret this incident happened. We take the privacy and security of guest information very seriously and continue to work hard to meet the standard of excellence that our guests expect from Marriott.”

Marriot had admitted to half a billion individuals data had been stolen.

Hotel guests who have previously made a reservation to stay at any of the following, Marriott or Starwood hotel (among others, the group also owns the Sheraton, Ritz-Carlton, and Renaissance brands) should go to the Starwood web page about the data breach.

Tips

Your data may be used by criminals who want to use your identity for financial gain.  Go to the website and check if the breach is relevant to you.

Some password managers and Antivirus products automatically tell you if they find your credentials being used elsewhere. This can include credit card information, email addresses and passwords for sites that you need a login.

Be proactive and get good security awareness advice

[1] https://www.theregister.co.uk/2019/07/09/marriott_hotels_ico_fine_intention_99m_starwood_breach/


Book now for a strategy call

Category: Safety Tags: ,

Book a Strategy Session Today to discuss your Training Needs

Book now