How to Protect Client Data. What Would a Criminal Pay for Your Client List?

What would a criminal pay for your client list?

Less than you’d hope. Criminals buy and sell stolen logins and network access on underground forums every day. According to dark web pricing research summarised by DarkOwl, typical access to a business network sells for a few hundred to a few thousand dollars, and one analysis put the average initial access listing in 2024 at about US$1,295.

For that price, a criminal can get into your email and files, and from there to everything your clients have trusted you with:

• Contact details: Names, emails, phone numbers and addresses that can be sold or used for targeted scams.
• Financial information: Invoices, bank details and payment history that make fake invoice scams far more convincing.
• Confidential documents: Contracts, tax files, health information or legal advice that clients expect you to keep private.
• Your email account itself: A trusted mailbox criminals can use to phish your clients, suppliers and staff.

The cost to your business is very different. A data breach can mean urgent IT work, legal advice, notifying clients and, for many businesses, reporting to the Office of the Australian Information Commissioner (OAIC). The hardest cost to recover is trust.

Why protecting client data matters for Australian businesses

Stolen passwords sit behind a large share of cyber incidents and data breaches. The numbers make it clear:

• Passwords alone aren’t enough: The ASD now says passwords by themselves no longer protect personal and business information, and is urging everyone to switch on MFA.
• Breaches are rising: The OAIC received 1,205 notifiable data breach reports in 2025, up 8% on the year before.
• Stolen logins feed ransomware: Verizon’s 2025 Data Breach Investigations Report found 54% of ransomware victims had company credentials exposed in infostealer logs before they were attacked.

Five ways client data leaks from small businesses

Most client data doesn’t leak through a dramatic hack. It walks out through small, everyday gaps. Check your business for these:

• Gap 01
  Reused passwords
• Gap 02
  No MFA on email
• Gap 03
  Passwords in spreadsheets or notes
• Gap 04
  Ex-staff who can still log in
• Gap 05
  Client data on unmanaged phones

• Reused passwords: When one website is breached, criminals try the same email and password on Microsoft 365, Xero and banking. This is called credential stuffing, and it works because people reuse passwords.
• No MFA on email: Your email is the key to everything else, because it’s where password resets go. Without MFA, one stolen password gives a criminal full control.
• Passwords in spreadsheets or notes: A file called “Passwords” on a shared drive, in a notebook or on a sticky note is the first thing a criminal or a curious visitor looks for.
• Ex-staff who can still log in: Accounts that stay active after someone leaves are rarely watched, so misuse can go unnoticed for months.
• Client data on unmanaged phones: Verizon found 46% of compromised devices holding corporate logins were unmanaged, such as personal phones and home computers.

None of these need expensive technology to fix. They need clear rules, the right settings in Microsoft 365 and a team that understands why it matters.

The 3 basics that protect client data

You don’t need to be a security expert to protect client data. These three basics stop most account takeovers, and they work best together:

• Basic 01
  Use passphrases, not passwords
• Basic 02
  Store them in a password manager
• Basic 03
  Turn on MFA, starting with email

• Use passphrases, not passwords: Choose at least four random words, such as “crystal onion clay pretzel”. The ASD recommends passphrases because they’re long, hard to guess and easy to remember. Never reuse one across accounts.
• Store them in a password manager: A business password manager generates strong, unique passwords, fills them in automatically and lets you share logins safely. Staff only need to remember one strong passphrase.
• Turn on MFA, starting with email: MFA asks for a second check, such as an authenticator app or passkey, so a stolen password isn’t enough. Start with email and Microsoft 365, then banking, payroll and finance apps. Where possible, use phishing-resistant MFA.

Still relying on passwords alone? Our guide on why passwords alone won’t protect you explains the risks in more detail.

Beyond passwords: six more ways to protect client data

Passwords and MFA protect the front door. Protecting client data properly also means thinking about what you collect, who can see it and what happens if something goes wrong. The OAIC’s guide to securing personal information sets out the “reasonable steps” Australian businesses are expected to take. In practice, that comes down to these six habits:

If your business is covered by the Privacy Act, these steps also help you meet your obligations. The OAIC’s data breach preparation and response guide is a good starting point for your response plan.

Your data on their phone: devices and departing staff

Client data doesn’t only live on your server or in Microsoft 365. It lives in email apps, Teams chats and downloaded files on phones and laptops, including staff’s personal devices. If one of those devices is lost, sold or belongs to someone who leaves, your client data can go with it.

The answer for most small businesses is to manage the data, not necessarily the whole device. Our article on MAM vs MDM for Microsoft 365 BYOD security explains how app protection policies let you protect company data on personal phones without taking control of staff’s personal photos and apps.

When someone leaves, follow the same checklist every time:

• Disable their accounts on their last day: Block sign-in to Microsoft 365, email and every business app, and sign them out of all active sessions.
• Change shared passwords: Update any shared logins they knew, such as social media, supplier portals and Wi-Fi.
• Remove company data from their devices: Use Microsoft Intune to selectively wipe work apps and files from phones and laptops.
• Forward or archive their mailbox: Keep client emails accessible to the team without leaving the account active.
• Check who still has access: Review shared folders, password manager vaults and admin accounts.

What to do if a password is stolen or a device goes missing

Speed matters. The sooner you act, the less time a criminal has to get to your client data.

• Step 01
  Change the password
• Step 02
  Sign out everywhere
• Step 03
  Check for hidden changes
• Step 04
  Tell your IT provider
• Step 05
  Report it if needed

• Change the password: Change it straight away, plus any other account where the same password was used.
• Sign out everywhere: Sign the account out of all devices and sessions, and wipe company data from a lost or stolen device.
• Check for hidden changes: Look for new MFA methods, mail forwarding rules or inbox rules a criminal may have added.
• Tell your IT provider: They can check sign-in logs, see what was accessed and lock down other accounts.
• Report it if needed: Report cybercrime through ReportCyber or call 1300 CYBER1 (1300 292 371). If personal information may have been exposed, check whether you need to notify the OAIC under the Notifiable Data Breaches scheme.

We’ll cover incident reporting in more detail in week 4 of this series.