If your data breach involves customer data, we highly recommend you consider telling your customers.

However, in the scenario where no customer data is compromised, the criteria for notifying customers under Australia’s Notifiable Data Breaches (NDB) scheme might not apply. Here are some scenarios where a company might not be required to inform customers about a cyber breach or attack:

1. Internal Data Compromise: If the breach only affects internal company documents or confidential information not related to customers or their personal data, the obligation to notify under the NDB scheme may not be triggered.
   
   
2. Ransomware Without Data Exfiltration: In instances where ransomware attacks lock access to company files without extracting data, and there’s no evidence that any customer data was accessed or compromised, notification may not be necessary.
   
   
3. Blackmail Targeting Non-Customer Information: If attackers threaten to release or destroy internal company information (e.g., proprietary business information, internal policies, etc.) without involving or risking customer personal information.
   
   
4. Successful Containment Before Risk to Customer Data: If a cyber attack is detected and contained swiftly, ensuring that no customer data was accessed, disclosed, or otherwise compromised, the company might not need to notify customers, focusing instead on internal remediation and security reinforcement.
   
   
5. Attack on Non-Personal Data Assets: Cyber attacks targeting assets unrelated to personal data, such as operational technology systems or machinery that do not store or process customer information, would not typically necessitate customer notification.
   
   
6. Invoice Fraud: This occurs when attackers deceive a company into paying fake invoices by impersonating a legitimate vendor or partner. Since this type of fraud typically targets the financial transactions between businesses and their suppliers without affecting customer data, it may not necessitate customer notification.
   
   
7. Business Email Compromise (BEC): BEC attacks involve the fraudulent takeover or imitation of company email accounts to manipulate employees into transferring money or revealing sensitive company information. As BEC scams generally focus on deceiving the company’s staff and do not involve accessing or compromising customer data, notifying customers might not be required under the NDB scheme.

In these cases, the cyber incidents have significant implications for business operations, financial integrity, and competitive positioning but do not directly impact customer personal information. The primary concern for businesses in such scenarios is to address and mitigate the breach’s effects internally, secure their operations, and prevent future incidents. However, it remains essential for businesses to thoroughly assess the impact of any breach, ensure that no customer data was indirectly affected, and consider the broader implications for customer trust and business reputation when deciding on disclosure.