When hackers compromised Booking.com’s supply chain in April 2026, the real attack started the next day with a flood of hyper-targeted phishing emails to genuine customers. When 20,000 Australian superannuation accounts were drained in the April 2025 super fund attacks, the attackers did not hack the funds. They used credentials stolen from unrelated breaches to log in as the real members. Every day in Australia, phishing emails, smishing texts, and vishing calls are bypassing technology and walking straight into inboxes that belong to trusted staff. Phishing attack prevention is no longer about training staff to spot bad grammar. It is about rebuilding the layers of defence that assume one email will get through, because it will.
Why 2025 Was the Year Phishing Got Personal
The modern phishing attack is almost unrecognisable compared to five years ago. In 2025 and 2026, Australian businesses are facing:
- AI-generated emails that read as natural as internal staff communications
- Deepfake audio and video impersonating CEOs and CFOs in real time
- Supply chain phishing where real trusted vendors are compromised first
- QR code phishing (quishing) sent on printed letters and inside document attachments
- Multi-channel attacks combining email, SMS, and phone calls on the same target
The ACSC recorded over 84,700 cybercrime reports in FY2024-25, with business email compromise, identity fraud, and phishing dominating the categories.
The Booking.com Supply Chain Phishing Attack
In April 2026, Booking.com confirmed that attackers had accessed customer names, emails, addresses, and booking details via a compromised third party. The immediate follow-up was a wave of convincing phishing emails to those customers, referencing real bookings and asking for payment “verification.”
This is the phishing attack of 2026: legitimate data stolen from one source, weaponised against real customers the next day, with specific and verifiable detail that defeats traditional detection.
The Super Fund Credential Stuffing Attack
In April 2025, more than 20,000 super accounts across AustralianSuper, REST, Hostplus, Australian Retirement Trust, and Insignia Financial were compromised. Attackers did not breach the super funds. They used credentials stolen from unrelated data breaches, betting that users had reused the same password.
Four AustralianSuper members lost a combined $500,000. A 74-year-old Queensland woman lost $406,000 overnight. The attack was pure phishing-derived credential harvesting combined with password reuse.
The Six Layers of Modern Phishing Attack Prevention
Technology alone will not stop phishing. People alone will not either. Modern phishing attack prevention requires six overlapping layers:
- Email authentication (SPF, DKIM, DMARC) to block domain spoofing
- Advanced email filtering to catch lookalike domains and display-name attacks
- Phishing-resistant MFA (passkeys, hardware keys) on every business system
- Unique-password enforcement via a business password manager
- Continuous security awareness training with realistic simulations
- Dark web monitoring to detect compromised credentials before they are used
Recommended Link: Security Awareness Training That Actually Works
The Process Controls That Matter as Much as Technology
Technology stops the easy attacks. Process stops the sophisticated ones:
- Callback verification for any payment or banking change request
- Out-of-band confirmation for urgent executive requests
- Separation of duties so no single person can release funds
- Clear reporting path for staff who see something suspicious
- “Pause and verify” culture where urgency is a red flag, not a reason to rush
Recommended Link: Email and Office 365 Security for Australian Businesses
How Confident Are You That Your Next Phishing Email Will Be Caught?
Phishing attack prevention is now a layered discipline. A single control is not enough.
- Run a phishing simulation across your staff this month
- Review your email authentication and MFA configuration
Frequently Asked Questions
Q: What is the single most effective phishing attack prevention control?
A: Phishing-resistant MFA on every business system. Microsoft’s own data shows it blocks more than 99.9% of automated credential attacks. It is not perfect, but nothing else comes close.
Q: How often should staff receive phishing training?
A: Quarterly at minimum, with monthly phishing simulations for high-risk roles such as finance, executive assistants, and HR. Annual training alone is not enough.
Q: If a staff member falls for a phishing email, who is responsible?
A: This is why a “pause and verify” culture matters. Staff who report incidents quickly should be supported, not punished. Blame cultures make phishing worse because staff hide mistakes.
The Booking.com incident, the super fund attack, the Qantas call-centre compromise, and every other major 2025-2026 Australian breach share one common feature: phishing, in some form, was the entry point. Phishing attack prevention is no longer an IT checkbox. It is the front line of your entire business. The question is whether you are treating it that way today, or whether you will be explaining to customers why you did not.
(We are not looking to replace your current provider, just offering an alternative perspective)
Written by Neil Frick
Sources & References
- Cyber News Centre – Booking.com Data Breach Exposes Supply Chain Vulnerabilities – https://www.cybernewscentre.com/14th-april-2026-cyber-update-booking-com-data-breach-exposes-supply-chain-vulnerabilities-as-customers-face-targeted-phishing/
- Cyber Daily – Hackers target Aussie pensioners in major super fund cyber attack – https://www.cyberdaily.au/security/11940-hackers-target-aussie-pensioners-in-major-super-fund-cyber-attack
- ASD Annual Cyber Threat Report 2024-25 – https://www.cyber.gov.au/sites/default/files/2025-10/Annual%20Cyber%20Threat%20Report%202024-25.pdf