Third-Party Risk Is Now Your Risk: Lessons from the Auto-IT Vendor Breach

Third-Party Risk Is Now Your Risk: Lessons from the Auto-IT Vendor Breach

A cyber incident at a software or IT provider can quickly become an operational problem for the businesses that depend on it. The September 2026 Auto-IT incident is a timely example for Australian organisations that rely on external providers for software, support or remote access.

The central lesson is straightforward: your vendors’ security can affect your security. That does not mean every supplier is unsafe. It means businesses need to understand who can access their systems, how that access is protected and what happens if a provider is compromised.

What was reported in the Auto-IT incident?

In September, Australian software company Auto-IT confirmed that a security incident affected a small number of customer environments. The company said it involved unauthorised use of a third-party remote monitoring and management (RMM) tool, and that it engaged cyber security and forensic specialists, worked with affected customers and liaised with the Australian Cyber Security Centre (ACSC). Auto-IT said the incident had been contained and customer environments remained operational, according to Cyber Daily’s report.

The Storm ransomware group claimed attacks against Australian dealerships and machinery-sector businesses. Reporting linked several organisations’ incidents to the third-party provider. Penfold Motors, for example, said an unauthorised party accessed some of its data stored in an external software provider’s system. It said the information involved was limited to basic contact details and vehicle and servicing information, and that it had notified potentially affected individuals. Read Cyber Daily’s report on Penfold Motors.

These reports do not establish that every customer of Auto-IT was affected, or that its core software platform was the point of entry. They do show why businesses should treat supplier access and incident communication as part of their own security planning.

What third-party risk means for a small business

Third-party or supply-chain risk is the risk that a supplier’s systems, people or security practices expose your business to a cyber incident. A supplier may store your data, connect remotely to your devices, manage your cloud services or provide software that is essential to daily operations.

The risk is not limited to large technology companies. A small business may depend on an IT provider, payroll platform, accounting package, booking system, cloud storage service or specialist industry software. If that provider has broad access, weakly protected credentials or unclear incident processes, a problem at the provider can affect your business.

The ACSC’s cyber supply-chain guidance recommends identifying suppliers and assessing the risks associated with their role and access. For small businesses, this is a practical starting point: know which providers can reach your systems and what they can do once connected.

Start with access, not assumptions

Remote support tools are legitimate and useful. They help IT teams resolve problems without waiting for an onsite visit. But a remote connection can also provide a route into business systems if an account, device or provider environment is compromised.

Make a current list of external access. Include remote support and RMM tools, cloud administrators, software integrations, shared accounts, service accounts and any vendor-managed devices. Record the business owner, supplier, purpose, access level and last review date for each.

Then reduce unnecessary access:

• Remove accounts and tools that are no longer used.

• Limit vendor permissions to the systems and tasks they need.

• Require multifactor authentication (MFA) on vendor accounts and remote connections.

• Use named accounts rather than shared credentials wherever possible.

• Require approval for access where practical, and set access to expire when the work is complete.

• Review access after staff changes, contract changes or a security incident.

These steps help keep legitimate support available while reducing the number of paths an attacker could misuse.

Questions to ask IT providers and software vendors

A supplier’s answers should be clear enough to document. If the information is unavailable, treat that as a gap to clarify, not as proof of a breach.

Who can access our environment?
Ask which staff, subcontractors and support providers can connect, and whether access is logged against named accounts.

Which remote access tools are installed or used?
Request a list of tools and their purpose. Ask how access is approved, restricted and removed when no longer required.

Is MFA required for every vendor connection?
Ask whether MFA applies to remote access and administrative accounts, not just ordinary user logins. Confirm how exceptions are handled.

How is access monitored?
Find out whether the provider records connection times, account activity and changes made during support sessions, and who reviews those records.

What is your incident response process?
Ask how the provider will contact you if an incident could affect your systems or information. Confirm who coordinates investigation, containment and recovery.

What do the contract and service terms require?
Check how quickly the provider must notify you of a suspected or confirmed incident, what information it will share and how it will support your response. Ensure the terms match your operational and legal requirements.

How do you manage your own suppliers?
A provider may rely on hosting companies, subcontractors or remote support platforms. Ask which parties could access or process your data, and how those relationships are assessed.

A strong supplier relationship includes written responsibilities, a practical escalation path and regular access reviews. It should not rely on informal assurances alone.

Monitor for unusual connections

Prevention matters, but it cannot remove all risk. Monitoring helps identify activity that does not match normal patterns, such as a connection at an unusual time, an unfamiliar remote access tool, a vendor account accessing unrelated systems or unexpected changes to security settings.

Keep endpoint and security tools current. Ensure logs are retained for an appropriate period and that someone is responsible for reviewing alerts and taking action. If a provider reports an incident, establish which accounts and connections to disable, what evidence to preserve and how to maintain essential business operations while the investigation continues.

Managed monitoring adds a control layer

For many small and medium-sized businesses, continuous monitoring is difficult to manage internally. Omnicron’s Managed Protection is designed to provide ongoing oversight of business IT, including monitoring and security-focused support. OmniShield Live Defence gives businesses clearer visibility into threat detection and system status, helping identify issues that may need investigation.

Monitoring does not remove the need to assess suppliers, use MFA or maintain good contracts. It adds a control layer: suspicious activity can be more visible, and a defined support team can help investigate and respond.

Practical next steps for Australian businesses

Start with three actions: document vendor access, remove tools and accounts that are no longer needed, and confirm MFA is enabled for all external connections. Then review supplier incident notification terms and make sure your team knows who to contact if a vendor reports a compromise.

These steps are relevant to any business that depends on external IT, but they are especially important for organisations that handle sensitive information or rely on uninterrupted systems, including professional services, medical practices, dealerships and manufacturers.

If your business needs help reviewing its exposure, Omnicron can assess access, identify security gaps and recommend prioritised actions through a security review. For ongoing support and monitoring, see Omnicron Managed Services.

Cyber threat protection for SMEs is not only about securing your own devices. It also means understanding the access and dependencies that extend beyond your business. A clear vendor inventory, tightly controlled connections and reliable monitoring can reduce avoidable risk and support business continuity.

This article provides general information and is not legal advice. Organisations should assess their own contractual, regulatory and incident-response obligations.