What the Slater and Gordon data breach taught us

Australian companies are increasingly facing privacy and data security threats, as shown by the recent payroll data breach involving leading law firm, Slater & Gordon.

This incident, which exposed sensitive employee payroll information, highlights how vulnerable organisations are, even those in trusted and highly regulated sectors.

What happened?

In February 2025, Slater & Gordon faced a significant privacy violation when confidential payroll data was leaked. According to the Australian Financial Review, only a small group of internal users could access the leaked data, suggesting the breach may have resulted from weak internal controls or compromised accounts.

Reports from the Australian Payroll Association call this breach a ‘wake-up call’ for organisations of all sizes, emphasizing that payroll data is a high-risk target due to the wealth of sensitive personal and financial information it contains.

Why privacy breaches matter:

Privacy breaches can have major consequences for businesses, including:

Financial loss from penalties and compensation claims.
Reputational damage and loss of client trust.
Operational disruptions and regulatory investigations.
Increased scrutiny from regulators under the Privacy Act.

For professional services firms, who are trusted holders of client and employee information, a data breach can be especially damaging.

How can businesses stay safe?

Here are practical steps you can take to reduce the risk of privacy breaches and protect your business:

1. Strengthen Access Controls.

Restrict access to sensitive data on a strictly ‘need to know’ basis.
Regularly review and update user permissions.
Use multi-factor authentication (MFA) for all critical systems, including payroll.

2. Train your people.

Run regular staff training on privacy, data security, and how to spot suspicious behaviour.
Foster a culture where employees are encouraged to report potential security flaws or incidents.

3. Review third-party providers.

Review payroll and IT suppliers for strong security credentials.
Ensure providers comply with Australian privacy laws and have robust incident response plans.

4. Monitor and audit system activity.

Implement monitoring tools to detect unusual access to sensitive information.
Schedule periodic audits of who has accessed confidential data and when.

5. Prepare ahead.

Have a clear data breach response plan and test it regularly.
Notify affected individuals and authorities promptly if a breach occurs.

The Slater & Gordon breach serves as an important reminder that privacy and security violations don’t just happen externally, it can happen from within the business too.

By adopting best practices in data security and privacy, businesses can protect their team members, clients, and reputation from the fallout of avoidable breaches.

Staying proactive isn’t just good risk management, it’s essential for maintaining trust in today’s climate.