Even the Big Four Get Breached: The Supplier-Risk Lesson for SMBs

A ransomware crew says it is sitting on close to 590GB of PwC's internal data. The claim is still unverified, but if one of the most security-resourced firms on the planet can end up on a leak site, the real question for every Australian small business is simpler: what happens to your data when one of your suppliers gets hit?

This week the Everest ransomware group listed PwC on its leak site, claiming roughly 590GB of stolen files, including HR records, training systems and internal documents reportedly spanning its Australian, UK, Canadian and China operations (as reported by Cyber Security News). PwC has not confirmed anything, and so far there is no evidence of encrypted systems or a ransom figure. Treat it as an allegation for now. But leak-site claims like this have a habit of turning real, and the uncomfortable lesson underneath it applies to businesses a fraction of PwC's size.

Why this matters if you run a small business

You do not have PwC's security budget, but you still hand your data to dozens of third parties who are bigger targets than you are: your payroll provider, your CRM, your booking platform, the cloud accounting file your bookkeeper logs into. Australia's privacy regulator recorded its highest-ever number of data breach notifications in 2025, and a large share of them reach a business through a supplier, not through a direct attack on the business itself. When a provider gets breached, your clients' data is in the blast radius too, and your clients will not care whose logo was on the login page.

In the Australian SMB environments we support around the Northern Beaches and Central West NSW, the pattern is almost always the same. Owners can rattle off the software they use, but very few can say what data each tool actually holds, or who at the vendor can see it. That gap is the risk. The firms that weather a supplier breach well are not the ones with the biggest security spend, they are the ones who already knew exactly what was stored where.

Four things worth doing this week

• Map your data. List every third party that stores your customer, staff or financial data, and what each one holds. You cannot protect what you have never written down.
• Minimise what you share. If a platform does not need a field, do not give it one. Less data stored is less data stolen.
• Check the contract and the config. Know how each supplier would notify you of a breach, and switch on the security settings (MFA, least-privilege access) they already offer you for free.
• Have a "supplier got breached" plan. Decide now who you would tell, how you would reset access, and what you would say to clients. Do not write it during the panic.

Written by Caleb Attard, All IT Services. All IT is a Sydney-based managed IT provider supporting hospitality, not-for-profit, professional services and wealth-management businesses across Sydney and Central West NSW.