Downtime tells the stories of real IT disasters: the outages, ransomware attacks, data breaches and fake invoices that stopped businesses in their tracks, and turns each one into plain-English lessons for Australian business owners. Every Tuesday, one incident, told as a story: what happened, why, and what would have prevented it. Every Thursday, the Downtime Brief: the week's IT and cyber security news that matters to a small or mid-sized Australian business. No jargon, no scare tactics, just what to do about it.
Downtime is brought to you by Complete Uptime Solutions , managed IT and cyber security for Australian businesses. Get a free IT risk snapshot at completeuptimesolutions.com.au or call 02 8214 4612.
Every episode ends with the same practical question: what would this have looked like in a 20-person business in Sydney, and what would have stopped it? The answers are the same things we build into every managed environment: tested backups, monitoring and patching, MFA and a plan for the day something breaks.
Just before 5 am on Friday 7 May 2021, a control room employee at Colonial Pipeline, which carries nearly half the fuel used on the US east coast, found a ransom note on a computer screen. Within about an hour all 5,500 miles of pipeline had been shut down, and within days petrol stations from Atlanta to Washington were running dry. The way in, the company later told the US Senate, was a legacy VPN account that was not meant to be in use and was protected by nothing more than a password. This episode tells the story of the DarkSide ransomware attack, the US$4.4 million ransom, and how the FBI clawed back US$2.3 million of it.
On Friday 19 July 2024, a routine content update from security company CrowdStrike crashed about 8.5 million Windows computers into blue screens. Airlines, hospitals, banks, broadcasters and supermarket checkouts across Australia and the world stopped mid-afternoon, and many organisations spent days fixing machines one at a time. This episode tells the story, explains the root cause in plain English, and follows the money, including Delta Air Lines' half-billion-dollar fight with CrowdStrike.
In June 2017 a poisoned update to a small Ukrainian accounting program unleashed NotPetya, a cyber weapon the US, UK and Australian governments later attributed to Russia. Within hours it had wiped the computers of the world's biggest container shipping company, A.P. Moller-Maersk, stopped chocolate production at Cadbury's Hobart factory and knocked a global law firm's phones and email offline. This is the story of how Maersk rebuilt roughly 4,000 servers and 45,000 PCs in about ten days, why its whole recovery hinged on one computer that happened to be switched off in Ghana, and what a cost of US$250 to 300 million teaches a 20-person Australian business.
At about 4:05 in the morning on 8 November 2023, Optus's network fell over. For roughly 12 hours, around 10 million customers and 400,000 businesses lost mobile, internet and landline services: hospital phone lines went down, Melbourne's trains stopped, card terminals stopped taking payments, and more than 2,000 people could not reach Triple Zero. We walk through what happened, what Optus told the Senate about the cause, and what followed: a CEO's resignation, a Senate inquiry, a government review and more than $12 million in penalties.
In October 2022 a criminal walked into Medibank's network using one IT contractor's saved username and password, and walked out with the personal details of about 9.7 million current and former customers, including health claims data. When Medibank refused to pay a ransom, the stolen records were posted on the dark web. This episode follows the attack from the first login to the government sanctions, the regulator's court case and the class actions that are still running today.
On the Friday before the US Independence Day weekend in 2021, a criminal ransomware operation abused a tool that IT providers use to look after their clients' computers. Through fewer than 60 directly compromised Kaseya customers, many of them managed service providers, ransomware reached up to 1,500 businesses, from New Zealand schools to Sweden's Coop supermarket chain, which had to shut most of its roughly 800 stores. This episode tells the story of the Kaseya VSA attack, from the Dutch volunteers who had already found the flaws to the US$70 million ransom demand, the mysterious universal decryptor and the hacker sentenced in Texas.
In August 2019 a European subsidiary of Toyota Boshoku, a car components maker in the Toyota Group, followed what it later called fraudulent payment directions and lost an expected four billion yen, about 37 million US dollars. This episode walks through what happened, why fake invoices and "our bank details have changed" emails work so well, and what the latest Australian figures say about payment redirection scams, which cost Australians $166.8 million in 2025.
In April 2022 a routine clean-up script at Sydney-founded software giant Atlassian was handed the wrong list of IDs and run in the wrong mode. Instead of removing one old app, it deleted 883 whole cloud sites belonging to 775 customers, and some of those businesses waited up to 14 days to get their Jira and Confluence back. This episode walks through what happened, why the restore was so slow, and what Atlassian's unusually candid post-incident review teaches every small business that runs on cloud software.
On 4 October 2021, a single command during routine maintenance cut Facebook off from its own data centres. Within minutes, Facebook, Instagram, WhatsApp and Messenger disappeared from the internet worldwide for about six hours, and engineers reportedly struggled even to get into the buildings to fix it. For the small businesses that took orders through Instagram and WhatsApp, the shop was simply shut.
Just before 1 am on 10 March 2021, a fire broke out in a power room at OVHcloud's data centre campus in Strasbourg, France. By morning one building was gone, part of another was destroyed, and an estimated 3.6 million websites were offline. Some customers discovered that their "backups" had been sitting in the same buildings as the servers they were meant to protect.
In March 2023, Australian lender Latitude Financial announced a cyber attack it first thought had touched about 330,000 people. Eleven days later the count was about 14 million records, including roughly 7.9 million driver licence numbers, many belonging to people who had stopped being customers years earlier. This is the story of how one set of stolen staff login details turned into what was described at the time as the largest known breach of an Australian financial company, why Latitude refused to pay the ransom, and what it cost.
