Bedford cyber incident update.

This public notification is to update Bedford (now Acclime) clients about the data breach which occurred in August 2025. This is not a new incident.

Acclime has now completed its investigation and is in the position to provide details about personal information that may have been impacted by the breach and outline the steps individuals can take to protect their information.

Acclime would like to take this opportunity to again unreservedly apologise for any distress that this incident may have caused.

What happened?

Bedford was the victim of a cyber-attack in August 2025 that resulted in a threat actor called “Akira” accessing some of our client data. Bedford acted immediately to contain the breach by disconnecting the affected server, closing administrative accounts and disabling access to prevent any further unauthorised activity. All staff passwords were reset and additional forensic software was installed. Our systems are being continuously monitored. We confirm that there is no evidence of publication of any Bedford or Acclime data online or on the dark web.

The issue was not limited to Bedford. Akira ransomware impacted several businesses that utilise Sonicwall Firewall, a third-party network security appliance.

Bedford reported the incident to the New South Wales Police and Australian Federal Police for investigation. We also notified and provided information about the incident to the Office of the Australian Information Commissioner (OAIC), the Australian Taxation Office (ATO), the Australian Cyber Security Centre (ACSC)/Australian Signals Directorate (ASD) and National Office of Cyber Security (NOCS).

We also continue to monitor income tax lodgements with the ATO to ensure there is no unexplained and potentially fraudulent activity on our clients’ accounts.

What kinds of information was impacted?

Acclime has undertaken a comprehensive analysis of the affected directory to identify potentially affected individuals and the personal information relating to them.

Only a small amount of data on the relevant directory was accessed before the incident was disrupted. The following types of personal information was affected:

• Contact information (address, email address, phone number)
• Name, date of birth
• Tax file numbers
• Director IDs
• Superannuation account numbers/employer IDs
• A small number of bank account details
• A very small number of passports/drivers licences
• A small number of Medicare numbers, health information and health insurance information

Support available to you

Where contact information was available for affected individuals, we have contacted those people directly. If you are concerned that you may have been affected:

• We have partnered with IDCARE, a national identity and cyber support service. IDCARE Case Managers are available Monday to Friday from 9am to 5pm (AEDT) and can be booked online via their Individual Get Help Form at https://www.idcare.org/contact/get-help#form or by calling 1800 595 160. Please use the referral code ‘BDRW25’. There is no cost to you.
• If you have any questions, please contact your Bedford/ Acclime advisor. They are happy to discuss.

Additional recommendations for you

We recommend clients also consider taking the following steps to protect themselves:

1. If you receive any unsolicited contact purporting to be from a known party but containing unexpected, urgent requests, action or instructions that are unusual, you should verify the authenticity of the correspondence in person or over the phone with the sender by contacting them directly using their published contact details. Do not attempt to verify the sender using any details that may have been included in a suspicious phone call, email or text received.
2. Remain vigilant as to any other attempts that might relate to possible identity theft or fraud using your personal information.
3. If you have any questions about government-issued identity document information (such as your driver licence, Medicare card or passport), please contact the agency that issued the identity document for advice. You can read more information about protecting yourself from identity fraud here: https://www.oaic.gov.au/privacy/your-privacy-rights/data-breaches/Identity-fraud.
4. Where you use software (online and desktop) to manage your accounting, tax, investment and other personal affairs we recommend the use of secure passwords and, wherever possible, multi-factor authentication (MFA).
5. If you use the ATO or MyGov portals, you should use your Digital ID, such as myID, set to the highest security level you can achieve to access those online services.
6. Additionally, the ATO’s app now has powerful new safety features designed to give users real-time control over their tax affairs through alerts and instant account locking to help stop fraudsters in their tracks. The app enhancements bolster the ATO’s existing fraud controls that have been in place for some time to detect unusual or out of pattern behaviour on taxpayers’ accounts. You can download the ATO app to set this up directly.
7. The ATO will also never send unsolicited messages with hyperlinks or ask for personal information via email or SMS.
8. If your bank account information was affected, monitor your bank accounts for any unusual or fraudulent activity. If you have any questions about your financial information (such as credit card details or online banking sign in), please contact your financial institution for advice. You can also request a copy of your credit report here: https://www.oaic.gov.au/privacy/your-privacy-rights/credit-reporting/access-your-credit-report to check if it includes any unauthorised loans or applications.
9. Visit the Australian Cyber Security Centre website here: https://www.cyber.gov.au/protect-yourself or the ACCC’s Scamwatch website here: https://www.scamwatch.gov.au/ for further information about online safety, cyber security and other helpful tips.

If you have any further questions or would like further information, please contact your Bedford/Acclime advisor.