The Lake Alice privacy breach exposed the identities of survivors in a preventable incident that went far beyond a simple email mistake. This case highlights critical failures in cybersecurity, information governance, and executive oversightand underscores the need for stronger, trauma-informed safeguards when handling highly sensitive public-sector data.

One compromised AI vendor, one stolen OAuth token, and everything your organisation trusted it with was exposed. The Vercel and Context AI breach of April 2026 revealed a critical blind spot most businesses have not yet addressed: the AI tools you approve can be used against you through vendors you never directly vetted. In this article, SeCompass CEO Jatinder Oberoi breaks down exactly how the attack unfolded, why it is part of a growing pattern of AI supply chain threats across Australia and New Zealand, and the five-pillar governance framework every organisation using AI tools needs to put in place now.

Most businesses moved on after EchoLeak was patched. The risk didn't. A single email — no malware, no click required — was enough to silently instruct Microsoft 365 Copilot to expose sensitive data. If your SME uses AI tools in daily operations, here is what you need to understand, and what to do about it.