Data Breaches and Security Standards in Project Management Software

• Trello Data Leak (Jan 2024): Trello, a popular project management platform, had 15 million user records scraped and put up for sale on a hacking forum (Data Breaches That Have Happened in 2024 & 2025 – Updated List). Attackers exploited an unsecured API that allowed querying of user profiles by email effectively enumerating accounts without authorisation (Email addresses of 15 million Trello users leaked on hacking forum). The leaked data which was names, usernames, and associated email addresses could facilitate targeted phishing or fraud attacks. Trello’s owner Atlassian confirmed the issue and tightened the API to prevent such enumeration albeit a little too late (Email addresses of 15 million Trello users leaked on hacking forum). While passwords weren’t leaked, exposure of contact details poses privacy risks and potential compliance issues.

• Atlassian/Envoy Breach (Feb 2023) – Australian software company Atlassian suffered a breach when hackers stole an employee’s credentials to a third party office management app (Envoy) and then accessed Atlassian’s employee directory data (Atlassian confirms breach of third-party app resulted in leak of employee data | SC Media). The compromised credentials (mistakenly posted publicly by an employee) let attackers pull internal employee records and office floor plans from the Envoy app (Atlassian confirms breach of third-party app resulted in leak of employee data | SC Media). Hackers leaked the stolen Atlassian employee data online, although Atlassian’s own products and customer data weren’t affected (Atlassian confirms breach of third-party app resulted in leak of employee data | SC Media) (Atlassian confirms breach of third-party app resulted in leak of employee data | SC Media). The incident highlighted the risks of third party SaaS (Software as a Service) integrations and the importance of securing employee logins (e.g. with strong authentication and avoiding credential exposure which one would think should be second nature in a company like Atlasian!).

• Optus Breach (Sept 2022): Optus which is Australia’s second largest telco company was hit by one of the country’s biggest breaches, affecting approximately 10 million customers (that’s like almost half of us) (2022 Optus data breach – Wikipedia). An API vulnerability caused by human error left a customer database endpoint publicly accessible without proper authentication (2022 Optus data breach – Wikipedia). Attackers enumerated customer records including names, Date of Birth, contact details, driver’s license passport numbers etc via this insecure API. The exposed personal data sparked government criticism and new legislation efforts (2022 Optus data breach – Wikipedia). Optus faced reputational damage, a class action lawsuit, and the company had to pay for replacements of identity documents (2022 Optus data breach – Wikipedia) (13 Biggest Data Breaches in Australia [Updated 2025] | UpGuard). This breach underscored how a simple misconfiguration can lead to massive data leaks.

• HWL Ebsworth Ransomware (Apr 2023): A top Australian law firm HWL Ebsworth (a professional services provider) fell victim to the ALPHV/BlackCat ransomware group. Hackers exfiltrated around 4 TB of data, including clients’ loan documents, IDs, financial reports, credit card details and government files (Australian law firm HWL Ebsworth hit by Russian-linked …) (A full timeline of the HWL Ebsworth data breach – eftsure). Investigation found that attackers initially compromised a lawyer’s login credentials likely via malware on a personal device to infiltrate the firm’s network (A full timeline of the HWL Ebsworth data breach – eftsure). Earlier speculation of unpatched software also arose (A full timeline of the HWL Ebsworth data breach – eftsure). The breach was devastating for the firm. Confidential client and even government data (e.g. defense projects) were leaked on the dark web (A full timeline of the HWL Ebsworth data breach – eftsure). The firm’s reputation suffered extensively and major clients withdrew their files, and a class action lawsuit was filed on behalf of affected individuals (A full timeline of the HWL Ebsworth data breach – eftsure). This case shows how one compromised account can cascade into a widespread breach in a project centric legal services or basically any kind of sensitive professional service provider.

• Accenture Attack (Aug 2021): Global consulting firm Accenture with a large Australian presence was attacked by the LockBit ransomware group (Accenture confirms data breach after August ransomware attack). Hackers claimed to have stolen 6 TB of data and demanded a $50 million ransom (Accenture confirms data breach after August ransomware attack). LockBit affiliates likely gained unauthorized access via phishing or a vulnerable remote service, consistent with their typical tactics (Accenture confirms data breach after August ransomware attack). Accenture stated that irregular activity was identified in an internal environment before the data extraction (Accenture confirms data breach after August ransomware attack). Proprietary company data and possibly some employee info was published by the attackers when Accenture refused to pay (Accenture confirms data breach after August ransomware attack). The firm restored systems from backups, reporting no disruption to clients (Accenture confirms data breach after August ransomware attack). Nevertheless, the incident highlighted that even cybersecurity savvy consulting providers are not immune and vigilance against malware and quick incident response are critical to limit damage.

Common Causes of these breaches

These incidents illustrate some recurring themes. Stolen credentials often via phishing or poor credential management are a leading cause of these incidents for example, ransomware gangs frequently start with a phished password (Notifiable Data Breaches Report: January to June 2023 | OAIC). Inadequate authentication security like not using multi-factor authentication (which is a basic step and is one of the first things we implemented in Gemma) can turn a stolen password into a full blown data breach. Australia’s InfoComm Commissioner found that Medibank’s massive 2022 data breach stemmed from exactly this problem. The insurer’s VPN lacked MFA, allowing hackers to reuse a contractor’s stolen login to access millions of records (Australian Regulators Detail Medibank Hack: VPN Lacked MFA). Unpatched software and misconfigured services are another root cause. Failing to promptly fix known vulnerabilities or leaving APIs open as seen with Optus and Trello gives attackers easy entry (2022 Optus data breach – Wikipedia) (Email addresses of 15 million Trello users leaked on hacking forum). Third party vendors and supply chain partners also pose risks. If their security is weak, it can compromise their clients, the Atlassian/Envoy case being a prime example here. Finally, human error such as accidentally exposing credentials or sending data to the wrong recipient remains a factor in many breaches, emphasising the need for staff training and security awareness.

Security standards and regulations for project management software

To address these risks, organizations should align with well known security standards and legal requirements. Key frameworks and regulations relevant to project management and professional services software include:

• ISO/IEC 27001: Information Security Management Standard. ISO 27001 is a globally recognized standard for information security management systems (ISMS) (ManageXR | ISO 27001 Certification: A Milestone in Information Security | ManageXR). It provides a structured framework for managing sensitive data and protecting it through a risk based approach (ManageXR | ISO 27001 Certification: A Milestone in Information Security | ManageXR). Companies that develop or use project management software often try to get ISO 27001 certification to demonstrate strong security controls like access control, incident management, encryption, supplier security and many others. Implementing ISO 27001 helps ensure continuous risk assessment, educated staff training, and overall improvement in security practices, which can reduce the likelihood of most data breaches.

• GDPR (General Data Protection Regulation): The GDPR is a rigorous EU data protection law that can apply to Australian service providers if they handle personal data of EU residents. It mandates privacy by design, robust data security, and prompt breach notification. GDPR sets a high bar for compliance. Regulators can impose fines up to €20 million or 4% of global annual turnover for violations (Navigating Privacy Laws: GDPR vs Australia Privacy Act – Securiti). This extraterritorial reach has pushed organisations worldwide to strengthen data handling and transparency. For project management tools, GDPR means ensuring features like consent controls, data export and delete capabilities, and protection of any personal data like employee or customer details within projects. Non compliance with this regulations can be costly but adhering to GDPR also generally aligns with good privacy practice and fosters trust with clients.

• Australian Privacy Act & APPs: Australia’s primary privacy law, the Privacy Act 1988, includes the Australian Privacy Principles (APPs) that govern how organisations must collect, store, and secure personal information (Navigating Privacy Laws: GDPR vs Australia Privacy Act – Securiti). It requires “reasonable steps” to protect personal data from misuse, loss, or unauthorised access. A clause under which companies can be penalised if they have poor security (as in the Medibank case) (Scathing report on Medibank cyberattack highlights unenforced MFA). The Act also contains the Notifiable Data Breaches (NDB) scheme, which makes it mandatory to notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a serious data breach occurs (Notifiable data breaches – OAIC). Penalties under Australian law have recently been stiffened. After recent high profile breaches, amendments in 2022 raised maximum fines to A$50 million or more, depending on company turnover for serious or repeated privacy breaches (Navigating Privacy Laws: GDPR vs Australia Privacy Act – Securiti). For project based professional service providers, compliance with the Privacy Act means implementing strong access controls, data minimisation, and breach response plans, since failure to do so could violate the APPs and incur heavy penalties.

• ASD and Secure Software Guidelines: The Australian Signals Directorate (ASD), through the Australian Cyber Security Centre (ACSC), publishes best practice guides for cybersecurity (which we religiously follow in development of Gemma). One cornerstone is the ASD Essential Eight which is a prioritised set of eight mitigation strategies aimed at hardening systems against attacks. This is what we follow in our office both for Eco Certificates and Gemma. The Essential Eight includes controls such as application allow-listing, prompt patching of applications and operating systems, restricting administrative privileges, and using MFA on all remote access (Essential 8 Cyberthreat Mitigation Strategies | ConnectWise). It is essentially a baseline cyber hygiene framework to build resilience against common threats in an office environment. Many Australian organisations and all federal agencies are encouraged or required to implement these controls at a defined maturity level (We’re sitting at level 1 at this point in time). In addition, ASD’s Information Security Manual (ISM) provides detailed secure software development guidelines, which cover practices like secure coding, input validation, regular code review, and use of frameworks such as OWASP’s standards (Guidelines for software development | Cyber.gov.au). You can check our compliance with these requirements at the security page of our website. Following ASD guidance means integrating security throughout the software development lifecycle. For example, performing threat modeling for new project management features, scanning for vulnerabilities, and ensuring cloud deployments meet ASD cloud security patterns. Adhering to these government endorsed practices helps reduce software vulnerabilities and meets the expectations for security when servicing Australian government or enterprise clients.

Best Practices for a secure project management software

Incorporating lessons from past breaches and guidance from authorities, professional service firms and software providers should adopt the following security best practices:

• Strong Authentication and Access Control: Enforce (or at least facilitate) multi factor authentication for all user logins, especially for remote and administrative access. Weak or single factor logins have enabled numerous breaches. Medibank lacked MFA on a VPN, allowing hackers to reuse stolen credentials to access millions of records (Australian Regulators Detail Medibank Hack: VPN Lacked MFA). Using MFA, strong unique passwords, and role based access limits helps prevent unauthorised access. Regularly review user accounts and eliminate unused or excessive privileges (following the least privilege principle) to contain potential damage if an account is compromised.

• Regular Patching and Vulnerability Management: Keep project management software and plugins up to date with the latest security patches. Many attacks exploit known vulnerabilities in systems that were left unpatched for a long time. For instance, speculation around the HWL Ebsworth hack pointed to unpatched software as a possible entry point (A full timeline of the HWL Ebsworth data breach – eftsure). Establish a routine to apply updates or security fixes for your project platforms without delay. In addition, conduct periodic vulnerability assessments or penetration tests on your environments. Timely patching, along with network safeguards like firewalls, intrusion detection systems etc closes the window of opportunity for attackers and aligns with ASD’s Essential Eight recommendations.

• Secure Configuration and API Management: Configure project management tools securely out of the box (which is what Gemma is). Disable or restrict any public facing APIs or endpoints unless absolutely necessary, and ensure proper authentication on them. The Optus breach demonstrated the havoc a misconfigured API can wreak (2022 Optus data breach – Wikipedia) so perform configuration reviews and cloud security audits. Use encryption for data in transit and at rest within the software to protect sensitive project data. Regularly verify that cloud storage buckets, project workspaces, and integrations are not inadvertently exposed. It’s also wise to follow “secure by design” principles: for any custom project software development, incorporate security in design  like input validation, error handling, secure defaults and use established standards (the OWASP Top 10 for web apps, for example) to prevent common flaws.

• Employee Training and Phishing Defenses: Human error is often the weakest link in most project based business service providers (unless the project management software they use is really bad), so invest in awareness training. Educate your staff about phishing, social engineering, and safe data handling. Breaches like HWL Ebsworth’s began with a single stolen login (A full timeline of the HWL Ebsworth data breach – eftsure), and the majority of ransomware incidents start with a phishing email (Notifiable Data Breaches Report: January to June 2023 | OAIC). Teach employees to recognise suspicious emails and not to reuse credentials across systems. Conduct regular phishing simulation tests and drills. The goal is to build a security conscious culture where users can spot and report potential attacks. As the ASD guidance notes, ongoing training helps staff “be sceptical of any email, link or download” and reinforces good practices (A full timeline of the HWL Ebsworth data breach – eftsure). Combining this with technical controls like email filtering or anti-malware tools can significantly reduce the risk of account compromise.

• Data Backup and Incident Response: Maintain robust backups of critical project data and test them periodically. Ransomware remains a major threat to project based businesses. Having offline, encrypted backups (or a secure cloud system like Gemma) ensures you can recover work data without paying ransoms. Equally important, have an up to date incident response plan. This includes predefined procedures for containing a breach, notifying clients and authorities (to meet the Notifiable Data Breach obligations (Notifiable data breaches – OAIC)), and recovering operations. A practiced response can dramatically reduce the impact of a security incident. For example, Accenture’s quick restoration from backups minimised their downtime during the LockBit attack (Accenture confirms data breach after August ransomware attack). Part of this planning is also involves engaging with security frameworks. consider getting audited for ISO 27001 or aligning with SOC 2, and ensure contracts with any third party providers include security requirements and breach notification duties.

By learning from recent breaches and adhering to these standards and best practices, project management software providers and professional services firms can better safeguard their systems. The stakes are high since sensitive project data is a lucrative target for attackers but with a proactive security posture, companies can significantly mitigate their risk. Strong compliance and security not only prevent breaches but also preserve and improves client trust and ensure business continuity in Australia’s increasingly regulated environment.