Short answer
Poole Group, a Sunshine Coast accounting and advisory firm, said it is responding to a cyber incident after the LockBit ransomware gang listed it on its leak site with a countdown to 25 October 2026. The firm says it has contained the incident and told the OAIC, the ACSC and the ATO.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Poole Group |
|---|---|
| Incident type | Ransomware |
| Status | Under investigation |
| Sector | Accounting and business advisory |
| Country | Australia |
| Disclosed | 2026-10-15 |
| People or records affected | Not disclosed. The firm says it will contact anyone found to be affected. |
What data was exposed
- Not confirmed. The firm says part of its IT environment was affected
- Claimed by the LockBit listing only: stolen data (types not stated by the gang)
What happened
Poole Group is an accounting and business advisory firm on Queensland’s Sunshine Coast. It was founded in 1980 and offers tax, accounting, superannuation, bookkeeping, HR, audit, wealth and property services.
Cyber Daily reported on 16 October 2026 that the firm had appeared on the dark web leak site of the LockBit ransomware group. A countdown timer ran to 25 October. Accountants Daily followed on 19 October.
What the firm has said
A spokesperson said Poole Group was “responding to a cyber incident that affected part of its IT environment in recent days.” It has:
- contained the incident;
- brought in external cyber security specialists;
- told the Office of the Australian Information Commissioner, the Australian Cyber Security Centre and the Australian Taxation Office.
The firm said it was still assessing the nature and scope of the incident. It said it would contact individuals directly if they were found to be affected.
What is claimed
LockBit’s listing is a claim. The gang did not say what it took and did not publish a ransom figure, according to both outlets. The reports do not name clients or describe the data. Ransomware gangs often exaggerate, and a leak-site listing alone does not prove that files were stolen.
Both reports describe LockBit as a ransomware-as-a-service operation that uses double extortion: it encrypts systems and also steals files to pressure victims. Accountants Daily says the group has been rebuilt several times after law enforcement takedowns and is now on its fifth version.
What we could not verify
We found no update after 19 October. We cannot say whether the countdown expired with files published, or whether clients’ tax file numbers, bank details or financial statements were involved. Treat any such statement as unconfirmed until the firm says otherwise.
Why accountant breaches matter
An accountant holds exactly what a scammer wants: tax file numbers, bank accounts, income, company structures and the names of family members. That makes follow-up fraud more convincing. A message that quotes your real accountant and a real tax matter may be fake.
Be careful with anything that arrives claiming to be from your accountant or the ATO. Our guides to phishing messages, urgent payment scams and government impersonation scams show common patterns. Our page on what to do after a data breach lists the first steps.
More incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake emails from 'your accountant' with a link to a document, invoice or tax return
- Calls or texts posing as the ATO about a refund or a debt, using details only your accountant would hold
- Requests to change the bank account for a refund or payment
- Fake superannuation or wealth statements that ask you to log in
What to do if you are affected
- 01If you are a Poole Group client, wait for direct contact from the firm. Do not rely on messages that merely mention the incident.
- 02Confirm any request for money, documents or changed bank details by ringing your accountant on a number you already have.
- 03Check your ATO online account through myGov for changes to your bank details or lodgements. Ask the ATO about extra protection if your tax file number is involved.
- 04Change passwords for any portal shared with the firm, and use multi-factor authentication.
- 05Report scams to Scamwatch and the incident to ReportCyber (cyber.gov.au). Contact IDCARE (free) if you think your identity is being misused.
Frequently asked questions
Has Poole Group confirmed a data breach?
It has confirmed a cyber incident affecting part of its IT environment. It has not confirmed that data was stolen or published, and says it is still assessing scope.
What did LockBit claim?
LockBit listed the firm on its dark web leak site with a countdown to 25 October. According to Cyber Daily, it did not say what data it took or name a ransom.
Is my tax information at risk?
Unknown. Poole Group offers tax, accounting, superannuation and wealth services, and has told the ATO. It will contact individuals it finds to be affected.
Was the data leaked after the 25 October deadline?
We could not verify whether anything was published. Check Poole Group's notices for updates.
What is LockBit?
A ransomware-as-a-service group founded in 2019 that encrypts and steals data. According to Accountants Daily, it has been rebuilt several times after law enforcement takedowns and is now at version 5.0.
Sources
- Exclusive: Poole Group investigating LockBit ransomware attack, Cyber Daily, 2026-10-16
- Accounting firm investigating ransomware attack, Accountants Daily, 2026-10-19
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.