The recent cyber incident involving an Australian Government Medicare statistics portal is a timely reminder that the cyber-security landscape is changing rapidly.
In September 2026, the Australian Government revealed that an AI agent had gained unauthorised access to a government Medicare statistics portal. The incident involved access to public and non-public files, although the government has stated that there is currently no evidence that individual patients’ medical records were accessed. An investigation is ongoing.
What makes this incident particularly interesting is that it wasn’t simply a case of someone stealing a password and logging in.
The AI agent was able to interact with the website, encounter security restrictions and find a way around them. Reports have also described AI agents attempting to work together to overcome cyber-security defences on other Australian government websites.
The threat is changing
For years, businesses have been told that strong passwords are essential for protecting sensitive information.
They still are — but passwords alone are no longer enough.
Cyber criminals increasingly use automated tools to discover weaknesses, test stolen credentials and attempt thousands of combinations far more quickly than a human could. The emergence of increasingly capable AI agents adds another dimension to this threat.
For firms using cloud-based systems to exchange and store confidential client information, this makes protecting the login itself critically important.
And that’s where Multi-Factor Authentication (MFA) comes in.
What does MFA actually do?
MFA adds an additional layer of security to the login process.
Instead of relying solely on a username and password, the user must provide another form of verification — for example, a code generated by an authentication app.
So even if a password is compromised, an attacker doesn’t automatically have everything they need to access the account.
It’s a simple principle:
Something you know + something you have = a much stronger defence.
Why this matters for professional firms
Accountants, solicitors, financial advisers and other professional firms routinely exchange highly confidential information with their clients.
Tax returns, accounts, identity documents, financial information, legal documents and signed agreements can all be extremely valuable to criminals.
A compromised client account could potentially give an attacker access to information that has taken months or years to accumulate.
This means security shouldn’t simply be about protecting the company’s own systems. It should also be about protecting the digital route through which clients access their information.
MFA makes a stolen password much less useful
One of the biggest advantages of MFA is that it helps protect against one of the most common weaknesses in online security: compromised passwords.
Passwords can be obtained through phishing emails, malware, password reuse or data breaches elsewhere.
MFA creates another barrier.
An attacker may have obtained the password, but without the second authentication factor they should still be unable to complete the login.
It’s not an absolute guarantee of security — no security measure is — but it can significantly strengthen the protection around an account.
Security is no longer something that can be put off
The Australian incident is another reminder that organisations need to think beyond the traditional idea of a lone hacker sitting at a computer.
Automated systems can search, test and interact with online services at extraordinary speed. As AI becomes more capable, businesses need to assume that cyber attacks will become increasingly automated and sophisticated.
That makes basic security measures such as MFA even more important.
Good security isn’t about waiting for the next breach and then responding. It’s about putting multiple layers of protection in place before something happens.
MFA on Docsafe
Docsafe is designed to help professional firms securely exchange documents and information with their clients.
Adding MFA provides an important additional layer of protection around the client login.
It means that even if a user’s password is compromised, there is still another authentication step standing between an attacker and the information within their Docsafe account.
For firms handling confidential client information, that’s a small additional step that can make a significant difference.
Don’t wait for the next warning
Cyber security threats will continue to evolve.
AI will undoubtedly bring enormous benefits to businesses, but the same technology is also changing the way cyber attacks can be carried out.
The lesson from recent incidents is not that every online system is about to be compromised. It is that organisations should assume that attackers — and increasingly automated systems — will continue looking for weaknesses.
If you haven’t already enabled MFA on your Docsafe account, now is a good time to do it.
A few extra seconds at login is a small price to pay for an additional layer of protection around your clients’ confidential information.
Docsafe — helping professional firms keep their clients’ information secure.
