A regional Victorian real estate agency has fallen victim to a data breach.
PH Property Bendigo sent an email to clients yesterday afternoon saying a staff member's email address was hacked on March 15.
The hackers managed to get past security protocols by the company that include randomised passwords, two-factor authentication for all email accounts, and an in-house internet firewall security system.
The company said four months of data was stolen that could affect about 200 customers.
Data stolen may have included names, contact information, bank details and documentation confirming identity.
The company said the cybercriminals were now targeting some clients of the small business using an email address with the first name Kayla.
"You may have already received a fake email from her account requesting to open an attachment – please do not open these attachments," the company said.
"Our current information shows that they have only emailed clients so far, however, there is a possibility that they have made a local copy of Kayla's entire email account and will have access to any email that has been sent to or from her."
The real estate agency said it has wiped the workers' computer, reported the data breach to the Office of the Australian Information Commissioner, and hired IT experts to help.
Anyone who is a client of the agency is being urged to review their bank statements for any unusual activity and change any password associated with company accounts.
'Happening every day'
Central Victorian Cyber security expert Brenton Johnson said these types of data breaches were happening every day across Australia, making life harder and more expensive for small businesses.
Mr Johnson praised PH Property for moving swiftly and said he was surprised the hackers got past the tight security measures.
He said people should be asking businesses more often how their data was being handled.
"When providing sensitive or identity information, you should ask the organisation what data is kept, how they protect your data, how long they retain your data," Mr Johnson said.
"A breach like this could give a hacker enough information to open a bank account in your name, apply for credit cards and potentially convince your bank or mobile phone company that they are you.
"With a breach like this, you can't put the toothpaste back in the tube. As shown Medibank and Optus hacks, it's very difficult to change your identity information once it is breached."
However Mr Johnson advised businesses to avoid wiping computers if they are hacked.
"It's generally not recommended to wipe the computer generally. The best option is to remove the hard drive and put in a new one," he said.
"Reason being this erases all evidence and may impact any insurance claim they have."
