When Japan Airlines disclosed in late October that a breach at booking technology provider Amadeus had exposed the data of 92,000 customers, including passport numbers for roughly 2,000, the airline was not the only business caught up. Cathay Pacific confirmed around 53,000 bookings were compromised through the same system, with reports suggesting the unauthorised access went undetected for up to three years.
Days later, closer to home, Australian holiday park operators including Reflections Holidays began warning guests about phishing messages that referenced genuine bookings made through RMS Cloud, a platform used by more than 6,000 accommodation providers worldwide. RMS Cloud confirmed it was investigating a “global incident” and said it had begun issuing new credentials to integration partners.
Neither the airlines nor the holiday parks were breached directly. Both were exposed through a vendor they trusted with customer data – and the ESET Enterprise Cybersecurity Report 2026 shows this pattern is far more common than many Australian businesses realise.
Read more: Third-party breaches push brokers toward vendor risk
The ESET report surveyed 400 cybersecurity decision makers across Australia. It found that 27% of organisations that suffered a major cyber incident in the past 12 months traced it to a third-party or supply chain compromise. Overall, 72% of respondents had experienced at least one major incident, and 21% reported data exfiltration.
Password and credential compromise was the leading cause, cited by 37% of respondents, yet only 61% of surveyed organisations have implemented multi-factor authentication (MFA) across their systems.
Detection speed compounds the problem. Only 32% of organisations identified a breach within the first hour, and 53% named delayed detection as their top incident response challenge. Twelve per cent only learned of an incident after being notified by an outside party, the same scenario both the Amadeus and RMS Cloud cases represent.
Tony Anscombe, chief security evangelist at ESET, warned in the report that current response times are insufficient. “In today’s threat landscape, 24 hours is simply not fast enough, let alone days, weeks or even months. The longer an attacker remains undetected, the more opportunity they have to move through an environment and cause damage,” Anscombe wrote.
Read more: Perth arrests reveal the supply chain blind spot in Australian cyber cover
The scale of vendor-driven incidents is changing how underwriters assess risk. MFA has become a baseline control Australian cyber insurers check during underwriting, and clients without it increasingly face higher premiums, reduced limits, or outright declines.
Many policies also require businesses to hold written contracts with their technology vendors before contingent business interruption losses are covered, a condition smaller organisations rarely meet. In July 2025, a Queensland government department lost $809,000 after attackers accessed its systems through a third-party telecommunications provider, a case that tested whether standard cyber arrangements respond when the breach originates outside the insured’s own network.
Joerg Schmitz, Aon’s cyber risk quantification and analytics leader for the Asia-Pacific region, has noted the structural nature of the risk. “The most lucrative attacks are those that can be scaled across multiple targets through a single compromised supplier,” Schmitz said.
The ESET report bears this out from the buyer side. It found 95% of Australian organisations face challenges obtaining or maintaining cyber insurance: 47% pointed to rising premiums, 42% to stricter insurer requirements, and 42% to limited budgets.
Vicky Sheridan, senior claims specialist for cyber at AXA XL Australia, has flagged the same trend. “We’re also seeing growing exposure to cyber risks arising from third-party technology providers,” Sheridan said, adding that “localised disruptions can trigger cascading effects across interdependent organisations.”
The Australian Prudential Regulation Authority’s (APRA) Prudential Standard CPS 234 requires regulated entities to maintain information security controls that extend to third-party service providers. CPS 230, which commenced in July 2025, broadened the obligation by requiring regulated entities to identify, assess, and manage material risks from service providers as part of their operational resilience frameworks.
For brokers advising clients in financial services, superannuation, or insurance, these standards create a compliance baseline that aligns with what underwriters are already asking for.
Andrew Hall, CEO of the Insurance Council of Australia (ICA), has said that “improving cyber literacy will help SMB decision-makers balance insurance costs with preventive measures” – advice that extends to helping smaller clients understand which vendor relationships carry insurable risk and which carry gaps.
The travel booking breaches are a reminder that a client’s cyber exposure does not stop at their own network perimeter. Brokers who help clients map vendor dependencies, verify controls such as MFA, and check whether their policy wording covers vendor-triggered losses will be better placed as insurer scrutiny of supply chain risk continues to sharpen.
