A small incident with large consequences
It’s a busy Friday afternoon at AK Jwwels. An employee signs in to the company email using the same login details as those used for several shopping websites. One of those websites had a data breach a few months ago, which allowed criminals access to thousands of usernames and passwords.
Criminals use automated tools to test leaked passwords at other online sites. Because the AK Jwwels employee has used the same password on those sites, they are able to access the business email. They read customer enquiries, change passwords on other business systems, and try to divert customer payments into their own bank accounts.
The incident could have been avoided by using a unique password for the email and enabling multi-factor authentication (MFA).
Why secure passwords are important
Passwords are the first defence for almost every business system. They are used to access business email, banking, file storage systems, customer databases and business social media accounts. If a password is compromised or used on multiple websites, criminals can often breach businesses without any hacking skills.
Strong passwords reduce the risk of unauthorised access to business systems. If passwords are not reused across multiple websites, only the breached account will be compromised and not other business systems.
For a business like AK Jwwels, the security of their customer data and maintaining the trust of their customers is just as important as protecting their goods in store. Being unable to access the business email, banking system and customer information may cause disruptions to daily business operations, delays to customer orders, and damage to the reputation of the business. (Australian Cyber Security Centre [ACSC], 2025)
What is multi-factor authentication (MFA)?
Multi-factor authentication (MFA) is an additional security feature that helps to protect accounts, requiring more than just a password in order to log in. In addition to a password, MFA may require the user to approve a notification sent to their mobile device, to enter a one-time passcode, or to use biometric authentication such as a fingerprint.(ACSC, 2023)
Even if a criminal were able to steal a password using a phishing email or from a leaked database, they would still be unable to access the account without going through an additional step. This significantly lowers the risk of business accounts being accessed by a criminal.(ACSC, 2023)
Why should AK Jwwels use multi-factor authentication?
AK Jwwels uses many websites, such as business email, social media (Instagram and WhatsApp), cloud storage, internet banking and supplier accounts. These business systems are used to receive enquiries, pay suppliers and store invoices, customer enquiries and customer payment details.
If a criminal is able to access even one of these accounts, they may be able to access customer information, request changes to payment details, or even impersonate the business, leaving employees locked out of these systems.
Enabling multi-factor authentication on all the business systems used at AK Jwwels provides an additional layer of protection, making it harder for criminals to gain access to business systems even when a password has been compromised.
Tips for employees
Every employee at AK Jwwels should use the following password security measures:
- Create a unique and hard-to-guess password for each business account
- Do not use birthdays, names or simple words
- Keep passwords in a secure, online password manager
- Enable multi-factor authentication wherever possible
- Do not share passwords via emails, text messages or messenger apps
- Change your password if there are signs you have been targeted
(ACSC, 2025)By using these password security measures, businesses and customers will be better protected against cybercriminals.
What can you do?
Employees can protect your business by changing your password and enabling multi-factor authentication immediately if you have been notified of a suspicious login attempt or think your password is compromised. In addition, report the incident to the business owner or a manager you trust.
If you suspect you have been targeted, check your recent activity. Let customers know if you suspect your account has been used to impersonate AK Jwwels and gain access to customer information.
By taking these measures, the risk of financial loss and damage to AK Jwwels can be minimised.
In summary
Strong passwords and multi-factor authentication are two of the simplest and most powerful security measures that small businesses like AK Jwwels can use.
Passwords are the first layer of security, however multi-factor authentication (MFA) adds another layer of security. Accounts are safer even if a password has been compromised.
Employees should create unique passwords for every business system used at AK Jwwels, use MFA wherever possible and remain vigilant against suspicious login activity to protect customer information, maintain business operations and build customer trust.(ACSC, 2025)
Refrences
Australian Cyber Security Centre. (2023). Protect yourself: Multi-factor authentication. https://www.cyber.gov.au/sites/default/files/2023-03/ACSC%20-%20Protect%20Yourself%20-%20Multi-factor%20Authentication%20Guide.pdf
Australian Cyber Security Centre. (2025). Small business cyber security guide. https://www.cyber.gov.au/sites/default/files/2025-01/ACSC_Small_business_cyber_security_guide_January_2025.pdf
Rublon. (2026, May 14). What is multi-factor authentication (MFA)? [Infographic]. https://rublon.com/what-is-multi-factor-authentication-mfa/
OneLogin. (2026, March 25). What is multi-factor authentication (MFA) and how does it work? [Diagram]. https://www.onelogin.com/learn/what-is-mfa
AKJwwels cyberawareness 
Leave a comment