Australia's peak cyber security body fears an enormous amount of sensitive information may have bypassed normal security walls during a day-long Microsoft outage .
Global disruption of the company's Outlook and Teams finally eased on Saturday after about 24 hours of chaos that crippled online communications.
The mass outage forced some organisations to revert to fax and halted at least one European bond repurchase.
Described as a disaster for the Australian business sector, it has deepened questions about global reliance on a handful of major tech companies supplying essential software and the cloud infrastructure underpinning it.
The Australian Information Security Association (AISA) said organisations scrambling to keep working during the outage using personal email accounts, USB drives and other alternative platforms may have caused a major cybersecurity risk.
Your trusted source for staying up-to-date with the world around you. Get free daily news updates and analysis, straight to your inbox.
"When people can't access the systems they rely on, they find ways to keep working," AISA board director Doctor Rajiv Shah said.
"Given the massive number of organisations affected around the world, we could be looking at an enormous amount of information that has moved outside normal security arrangements in a single day," he said.
"We need to understand how much additional cyber risk has been created."
It mounts more pressure on Australian businesses feared to have lost billions of dollars within only 12 hours of the shutdown, according to Ashwin Pal from accounting firm RSM Australia.
"That's not just direct but indirect costs as well," he said.
"A protracted event like this can easily be the straw that breaks the camel's back for smaller entities."
He said his clients had activated business continuity and disaster recovery plans but many businesses didn't have a fallback.
"They're just at a standstill — if you don't actually have a plan B, then you've got a problem," he said.
Shah said businesses needed to build greater redundancy, such as independent communication channels, offline access to critical information and alternative ways to authenticate users in case of a major outage.
The Australian Computer Society renewed its call for a national review of sovereign risk in Australian IT, whilst Australian consumer groups said the outage highlighted a need for stronger complaints systems.
"Australians who couldn't get paid, couldn't send an invoice or couldn't reach a government service are entitled to be worried," chief executive of Computer Society Prins Ralston said.
"Where were the direct updates to Australian customers and media — and who will answer for the lost productivity and the cost to the economy?"
According to research by the Australian Communications Consumer Action Network, consumer trust in big tech is at an all time low with many feeling trapped using platforms they find hard to move from.
About 79 per cent of consumers want stronger protections for online services while 81 per cent say the apps they use are important to their day-to-day life.
