Cybersecurity in HR: Lessons Learned from Recent Cyberattacks in Australia

In recent years, the rise in cyberattacks has highlighted the critical need for robust cybersecurity measures. From major banks and telecommunication giants to mega corporations and healthcare providers like Medibank, no organisation is immune to these threats. The recent Australian superannuation funds hack is a stark reminder that every company, regardless of size or industry, is at risk.  

These breaches have not only exposed critical vulnerabilities but also highlighted the importance of protecting sensitive data. It should come as no surprise that some of the most sensitive data an organisation possesses is that of its employees, making cybersecurity in HR a top priority.

Why is HR data a prime target?

Your human resources and payroll systems are far more than just a backend operation. They’re a repository of highly sensitive information that demands top-tier security. 

Names, salaries, bank account details, tax IDs, and personal addresses — all these critical pieces of data reside within your HR & payroll platforms Naturally, this makes them an enticing target for cybercriminals looking to commit identity theft and financial fraud. 

Other sensitive data to be weary of includes, but isn’t limited to: 

• Employment Records: Information about employees’ performance reviews, disciplinary actions, and salary details can be exploited for various malicious purposes. 

• Health Information: Data related to employee health benefits and medical records is highly sensitive and valuable on the black market.

Why does HR & Payroll security matter?

HR & payroll data is a treasure trove for hackers. Yet, many companies still treat HR & payroll security as “just another” administrative task.  

This oversight creates significant vulnerabilities in their defences, which cybercriminals are eager to exploit, leading to substantial financial losses and severe compliance issues. 

Beyond the financial damage, the fallout of a payroll data breach includes: 

• Loss of Employee Trust: Breaches erode the confidence employees have in their employer’s ability to protect their personal information. 

• Regulatory Penalties & Fines: Non-compliance with data protection regulations can result in hefty fines and legal consequences, especially with regulations like GDPR and CCPA. 

• Brand Damage: A breach can tarnish an organisation’s reputation, affecting customer and partner relationships. 

• Operational Chaos: The aftermath of a breach often disrupts business operations, causing significant downtime and resource allocation to manage the crisis. 

Modern HR & payroll security is about more than password-protecting a spreadsheet. It’s about safeguarding the systems, processes, and platforms that hold your company’s most sensitive data.

What makes HR & Payroll Systems vulnerable?

To effectively secure HR & payroll systems, it’s crucial to understand the vulnerabilities that make them susceptible to cyberattacks. Here are some of the most significant threats:
 

1. Phishing & Social Engineering Attacks 

Phishing remains one of the most prevalent and dangerous methods for breaching payroll data. These attacks typically manifest as deceptive emails, texts, or phone calls that appear to come from trusted sources such as HR, finance, or payroll providers.  

When an employee clicks on a malicious link or divulges their login credentials, attackers can infiltrate the payroll system, alter direct deposit information, or extract confidential employee data without raising any alarms. 

2. Weak Access Controls 

In many organisations, excessive access to payroll data is a common issue. Without stringent access controls, junior employees, third-party vendors, or even former staff may retain access long after it is necessary.  

The more individuals with access to sensitive payroll data, the higher the risk of accidental leaks, unauthorised changes, or internal fraud. This problem is exacerbated if your business: 

• Uses shared logins across departments. 

• Grants administrative rights to multiple individuals “just in case.” 

• Lacks visibility and oversight into who is accessing what data. 

3. Outdated or Insecure Payroll Software 

Legacy payroll systems often lack modern security features and are infrequently updated to address new vulnerabilities. This poses a significant risk, as cyber attackers frequently exploit known software flaws.  

If your payroll system is not regularly updated, you are providing attackers with an easy entry point. This issue is particularly concerning if: 

• Your vendor no longer supports or maintains the software. 

• You rely heavily on manual backups or offline exports. 

• Your software does not enable multifactor authentication. 

4. Insecure Data Storage or Transmission 

Storing HR & payroll files locally, emailing spreadsheets, or using consumer-grade tools for payroll management exposes your data to unnecessary risks.  

If payroll data is not encrypted — whether stored on a drive or transmitted over a network — it can be intercepted, copied, or accessed by unauthorised individuals. This vulnerability is heightened if: 

• Payroll files are stored on shared drives or desktops. 

• Spreadsheets are sent via email without encryption. 

• USB drives are used for payroll backups. 

5. Third-Party Vendor Risks 

Even if your internal systems are secure, your payroll provider might not be. If your vendor lacks proper controls, certifications, or transparency, they could be the weakest link in your security chain.  

When a provider is breached, your employee data is compromised along with it. Many high-profile breaches have been traced back to compromised third parties. This risk is significant if: 

• They provide vague or insufficient answers to your security inquiries. 

• They do not submit to regular audits. 

• Are not transparent with their processes and controls to ensure the safety of your employee’s data. 

By understanding and addressing these vulnerabilities, organisations can better protect their HR & payroll systems and the sensitive data they contain.

The Double-Edged Sword of Technology in HR

In today’s fast-paced business environment, technology has revolutionised the way companies manage their human resource functions. From streamlining payroll processes to enhancing employee engagement, software solutions have enabled organisations to work more efficiently and effectively. However, this reliance on technology also introduces new vulnerabilities. 

With the rise of artificial intelligence (AI) and advanced software systems, many companies have developed an implicit trust in these tools. While AI can automate routine tasks and provide valuable insights, it is crucial to recognise that technology alone cannot safeguard against cyber threats. Over-reliance on software can lead to a false sense of security, leaving companies exposed to cyberattacks and data breaches.
 

The Risks of Over-Reliance on Technology 

• Implicit Trust in AI & Software 

Companies often assume that sophisticated software systems are infallible. This misplaced trust can result in underestimating the potential for cyber threats. AI and software are only as secure as the measures put in place to protect them. Without proper oversight, these tools can become entry points for cybercriminals.
 

• Underestimating Human Oversight: 

While technology can enhance HR functions, it should not replace the human element. Human oversight is essential for identifying anomalies, making judgment calls, and ensuring that security protocols are followed. Relying solely on software can lead to gaps in security that automated systems may not detect.
 

• Vulnerability to Cyberattacks: 

Advanced software systems are attractive targets for cybercriminals. Hackers continuously develop new methods to exploit vulnerabilities in AI and other technologies. Companies that rely too heavily on software without implementing robust cybersecurity measures are at greater risk of data breaches. 

Balancing Technology with Human Insight 

To mitigate these risks, companies should view technology as a complement to, rather than a replacement for, the human element in HR and payroll functions. Here are some strategies to achieve this balance: 

• Enhance Human Oversight: Ensure that HR and IT teams work together to monitor and manage software systems. Regular audits, manual checks, and human intervention are crucial for maintaining security. 

• Invest in Training: Equip employees with the knowledge and skills to recognise and respond to cyber threats. Continuous training on cybersecurity best practices can help bridge the gap between technology and human oversight. 

• Implement Robust Security Measures: Combine advanced software solutions with strong cybersecurity protocols. This includes multi-factor authentication, encryption, and regular updates to software systems to protect against vulnerabilities. 

• Foster a Security-First Culture: Encourage a culture where security is a shared responsibility. Employees at all levels should be aware of the importance of cybersecurity and their role in protecting sensitive data

• Choose a Reputable Human-Centric Partner: When outsourcing your HR & Payroll functions, ensure to choose a reputable, human-centric partner that prioritises HR cybersecurity as well as customer service. 

By integrating technology with human insight, companies can leverage the benefits of advanced software while minimising the risks associated with over-reliance. This balanced approach ensures that HR and payroll functions are both efficient and secure, safeguarding the sensitive data that is vital to the organisation’s success.

Key Takeaways

The recent superannuation breaches highlight the urgent need for robust cybersecurity measures within HR departments. These incidents have exposed critical vulnerabilities and underscored the importance of protecting sensitive employee data. HR and payroll systems, which house highly sensitive information, must be fortified with stringent security protocols and continuous oversight. 

While technology plays a crucial role in enhancing HR functions, it should complement, not replace, human vigilance. By integrating advanced software solutions with human insight, collaborating with a security-focused human-centric HR partner, as well as fostering a culture of shared responsibility, organisations can build a resilient defence against cyber threats.
 

How Polyglot delivers secure (human-centric) payroll & HR services. 

As a foreign subsidiary, it can be difficult to effectively implement and maintain many of the best practices above, especially if your resources are tight. 

This is why it’s advisable to work with a security-focused, human-centric payroll & HR partner like Polyglot. We invest heavily in our security, enabling you to benefit from our enterprise-grade infrastructure. 

Specifically, we: 

• Host our payroll infrastructure on isolated networks with strict, auditable access controls. 

• Use advanced firewalls, threat detection, and prevention mechanisms. We proactively identify vulnerabilities and remediate them.

• Your data is kept onshore and process by teams locally.

• Perform ongoing security audits, maintain logs of every change, and routinely run penetration tests to stay ahead of emerging threats.

• Have a dedicated in-house team focused solely on protecting your data. This includes annually auditing and testing our BCP & DRP, enforcing SSO, least privilege principles, and ongoing internal security training.

• Encrypt all payroll data at rest and in transit using best-in-class protocols. We also purge unnecessary data to reduce exposure.

• Require two-factor authentication (2FA) for every document sign-off. SSO is also available company-wide, making it easier for teams to stay secure without remembering dozens of passwords.

• Adhere to global privacy and compliance standards, including GDPR.