August was about noisy breaches.
September had fewer headlines, but the issues have been harder to ignore. Businesses have tightened up their perimeter since last month and things looked steadier, yet incidents still came through suppliers, cloud apps and simple configuration mistakes. Last month, people worried about attackers breaking in. This month showed how much damage happens when trust inside the system breaks down.
NSW Health data exposure
NSW Health confirmed a configuration error on 10 September left nearly 600 doctors’ personal records exposed online.
On the 10th of September, The Guardian reported that NSW Health had exposed the personal records of nearly 600 doctors. The documents included passports, IDs, and qualifications. They were left open on a public site due to a configuration mistake.
This was not a breach by criminals. It was an internal slip that created the same effect as an attack: private data in the open. September had several incidents like this where the risk came from inside systems rather than from the outside.
Security teams often focus on advanced threats, but configuration checks and peer reviews of sensitive systems are just as important. The mistakes may feel simple, yet the consequences are no different from a deliberate breach.
npm worm hits packages including CrowdStrike
A self-spreading malware campaign in the npm ecosystem was first reported on September 16, 2025. Researchers tracked a worm that began with @ctrl/tinycolor and then moved into other packages, including several published under CrowdStrike’s npm account. Counts moved quickly from 187 to hundreds of compromised packages as more findings landed across the week.
The payload hid in a bundle.js file and did two things that matter for defenders: it stole secrets (npm tokens, GitHub creds, cloud keys) and it persisted in CI by dropping GitHub Actions workflows, which let it publish into more packages using the victim’s own rights. That is why it spread fast and quietly.
Alert showing malicious bundle.js inside a compromised CrowdStrike package.
Gridware covered this incident in detail here
Canberra Cyber Centre
On the 16th of September, the ACT Government opened a new $5 million Cyber Security Centre of Excellence at CIT Woden. The centre is tied to CIT’s EV facility and will focus on securing connected vehicles.
Modern cars today are just computers with wheels. They can receive remote updates, collect telemetry and can be disabled at a distance. There’s a big chance that the next wave of cyber incidents might not be about servers or laptops. They may be about the cars we drive, the chargers we use and the systems around them.
Optus 000 outage
Optus has faced an independent review after a 000 outage on 18 September was linked to multiple deaths.
On the 18th of September, a firewall change at Optus disrupted the routing of 000 calls across multiple states. Hundreds of calls failed, and at least three deaths are being investigated in connection with the outage. An independent review is under way.
The change should have been caught by monitoring systems, but the alarms did not trigger or were not in place. Escalation also broke down, so the problem was not raised quickly enough for people to act. What started as a routine network change turned into a nationwide outage of a life-critical service.
What could have helped:
- End to end synthetic monitoring of emergency call paths to show in real time if a 000 call would connect.
- Real time monitoring of firewall and routing changes.
- Clear escalation rules that treat any outage in critical services as an immediate incident.
Stellantis breach
On the 22nd of September, Stellantis said attackers accessed data held by a service provider that supports its North American customer service operations. The company’s statement points to contact details being exposed, with no payment data confirmed. Notifications to customers and regulators are under way.
This sits inside a wider 2025 campaign against Salesforce tenants that relies on stolen or abused OAuth tokens and over-permissive connected apps.
What to do if you run Salesforce today:
- Revoke tokens for apps no one owns and rotate the rest
- Review app scopes and remove unnecessary “full access” permissions
- Add controls that make token abuse noisy, such as IP restrictions and high-risk login flows
Expect follow up phishing that looks like warranty or recall notices sent to Stellantis customers. Contact data is enough to stage convincing scams, so treating inbound messages with extra care is the practical response these coming months.
Perth OT firm alleged Akira ransomware breach
The Akira ransomware group listed Perth-based OT firm on 23 September, claiming to hold 10 GB of data.
On 23 September the Akira group listed Perth-based Intellect Systems on its site, claiming 10 GB of company and personal data. The breach has not been confirmed, but Akira has been active in Australia before, often through exposed VPNs and weak remote access.
Intellect is an operational technology supplier. If the claim is true, the impact goes beyond one firm to the industrial clients that rely on its systems. That is why OT providers remain prime targets for ransomware groups.
We covered the details and risks in our full blog on Akira’s claim against Intellect Systems.
Closing
The headlines slowed down in September, but the damage behind them was heavier. Systems were left open, suppliers exploited, and routine changes lead to real consequences. Almost every incident in September came from risks in already inside trusted environments.
As October begins, the focus should turn to the basics that often get overlooked. Test the suppliers you rely on. Audit cloud integrations that no one has touched in months. Review how internal changes are approved and monitored.
