Partner News: Could Your Association Survive a 3rd Party Cybersecurity Breach Like Qantas?

Published on Tuesday, 16 September 2025

Another breach. This time, Qantas’ 6 million frequent flyers were impacted, including me. If giants like Qantas struggle, what chance do Associations have?

The difference is that we have limited options when it comes to flying domestically. Your members? They often have choices.

If you lose their trust by failing to protect their data, could you survive?

Why IT providers are a big risk

Once, organisations stored and managed their own applications and servers. It was difficult, but at least you knew who was responsible.

Today, most Associations rely completely on third-party cloud software and Managed Service Providers. But outsourcing doesn’t guarantee security. The data is still yours, and if compromised, your members will hold you accountable.

Beyond IT

Third-party risks aren’t limited to IT providers: conference planners, direct mail firms, outsourced payroll… how do you know they’re keeping your data safe?

Too often, you don’t until it’s too late. Reports suggest Qantas’ breach involved an overly helpful offshore call centre worker. What training did they have? Have you asked your providers the same?

What You Can Do

Reduce risks by vetting all third parties before contracts are signed and reviewing them annually. Ask where data is stored, how it’s encrypted, who has access, what training staff receive, and how AI features are secured.

Third parties may be your biggest cybersecurity risk. Vet them early, review often, and keep asking tough questions.

If you’re unsure what to ask, I help Associations with this every day. Get in touch.

Tammy Ven Dange of Roundbox Consulting is a former Association President, charity CEO, Not for Profit Board Member and IT Executive. Today, she helps Associations and other Nonprofits with strategic IT decisions, especially around investments and mitigating cybersecurity risks.