Cyber fraud is not a technical problem — it is a legal emergency. When a business is hit by business email compromise, ransomware, phishing, or online payment fraud, the financial loss can be substantial and the legal obligations are immediate.

A successful attack is often an eligible data breach that must be assessed and, if eligible, reported to the OAIC under the Privacy Act 1988 (Cth). Reporting the crime itself to the AFP and the ACSC (via ReportCyber) is generally voluntary — but mandatory reporting applies to critical infrastructure incidents under the Security of Critical Infrastructure Act 2018 (Cth), and to ransomware or cyber extortion payments by larger businesses under the Cyber Security Act 2024 (Cth).

EAGLEGATE advises businesses, directors, and organisations on cyber fraud response — from the immediate steps after an incident through to legal proceedings, regulatory compliance, and civil recovery. Nicole Murdoch’s engineering and technology background means EAGLEGATE understands how cyber fraud operates technically — not just how the law responds to it.

A cyber fraud incident triggers legal obligations within hours. Evidence preservation and legal advice must begin simultaneously with the IT response — not after it.

Key Cyber Fraud Expertise — Respond, Report, Recover

EAGLEGATE advises on every form of cyber fraud affecting businesses.

Business Email Compromise (BEC)

Business email compromise is Australia’s most financially damaging form of cybercrime. It typically involves an attacker compromising a business email account — or spoofing one convincingly — and redirecting payment of an invoice to a fraudulent bank account. The loss is often discovered only when the legitimate creditor follows up non-payment. EAGLEGATE advises on: immediate notification to banks to attempt recall of transferred funds; tracing the fraudulent account; civil recovery proceedings; and assessment of Privacy Act obligations where email account compromise involved personal information.

Ransomware and Extortion

A ransomware attack — encrypting business systems and demanding payment for decryption — constitutes an offence under sections 477 and 478 of the Criminal Code Act 1995 (Cth). It also typically constitutes an eligible data breach under the Privacy Act 1988 (Cth) where personal information is accessed or at risk of being accessed. EAGLEGATE advises on: legal obligations triggered by the attack; whether payment of ransom is advisable from a legal and regulatory perspective; ACSC and OAIC reporting; and pursuit of civil and criminal referrals where the attacker is identifiable.

Phishing Attacks

Phishing attacks — fraudulent communications designed to induce individuals to disclose credentials, transfer funds, or provide access — can result in both immediate financial loss and downstream privacy breaches where credentials are used to access systems containing personal information. EAGLEGATE advises on evidence preservation, Privacy Act obligations, and civil recovery where the attacker is identifiable.

Online Payment Fraud

Online payment fraud — including fraudulent supplier invoices, payment diversion, and fraudulent refund schemes — causes direct financial loss. EAGLEGATE advises on immediate steps to halt or recall payments, civil proceedings against fraudsters, and regulatory reporting obligations.

Evidence Preservation

The most common error in cyber fraud response is an IT team that overwrites or remediates systems before evidence is properly preserved. Digital evidence — logs, email headers, network traffic, access records — is required for both civil proceedings and law enforcement engagement. EAGLEGATE advises on evidence preservation requirements before any remediation steps are taken.

1. Contain and Preserve Evidence

Simultaneously with any IT response: preserve relevant digital evidence — do not overwrite, reimage, or destroy systems before evidence is captured. We advise on what must be preserved and how.

2. Assess Legal Obligations

We assess whether the incident constitutes an eligible data breach under the Privacy Act 1988 (Cth), what reporting obligations apply — OAIC notification, ACSC and sector-regulator reporting, critical infrastructure incident reporting under the Security of Critical Infrastructure Act 2018 (Cth), ransomware or cyber extortion payment reporting under the Cyber Security Act 2024 (Cth), and cyber-insurer notification — and what employment law or contractual obligations are triggered.

3. Attempt Recovery

For financial losses, we pursue immediate bank notification to attempt recall of transferred funds, civil tracing proceedings to identify where funds have gone, and civil recovery claims against identified fraudsters.

4. Manage Regulatory Response

We manage OAIC notification, ACSC reporting, sector-regulator engagement, critical infrastructure incident reporting under the Security of Critical Infrastructure Act 2018 (Cth), and mandatory ransomware or cyber extortion payment reporting under the Cyber Security Act 2024 (Cth) — and advise on the interaction between civil proceedings and criminal referrals.