Key topics covered in this article:

• • A recent cyber incident at an Australian golf club shows that private clubs remain attractive targets for cybercriminals, putting sensitive member and business data at risk.
  • While a financial statement audit is not a cybersecurity assessment, discussions with your CPA can help identify operational, technology, fraud, and vendor-related risks that may warrant further evaluation.
  • Private club leaders should regularly assess payment fraud, data protection, business continuity, and cybersecurity governance to improve organizational resilience.

A Cyber Incident at a Private Golf Club Raises a Bigger Question

In June 2026, Pennant Hills Golf Club in Australia detected unauthorized access to its systems. The Qilin ransomware group subsequently claimed responsibility, and the club launched a forensic investigation. Although operations were not disrupted, investigators later confirmed that approximately 92.6 GB of data had been taken from historical internal file servers. The information potentially included business documents, employee records, and basic member contact information. The club notified relevant authorities, communicated with members and staff, and implemented additional security measures. The incident raises an important question for private club leaders: How prepared would your club be if your systems or member information were compromised?

Private clubs are communities shaped by connection, trust, and a shared sense of belonging. Names, addresses, banking details, payment information, and employee records may reside in club systems and with third parties supporting them. The cybersecurity landscape has changed significantly, while some club systems and processes have not evolved at the same pace.

Ransomware can interrupt dining, reservations, golf scheduling, and payment processing. Business email compromise can redirect vendor payments. A breach of membership systems could expose confidential member data and undermine the confidence members place in the club.

Many clubs rely on third-party providers for payment processing, membership management, payroll, reservations and IT support. Verizon’s 2025 Data Breach Investigations Report found third-party involvement in 30% of breaches, double the prior year. For clubs relying on payment processors, membership platforms and outsourced IT, vendor oversight is both a leadership and governance responsibility.

Your Annual Audit Can Start a Broader Risk Conversation

A financial statement audit provides an opinion on the financial statements. It is not a comprehensive cybersecurity assessment, fraud examination, or evaluation of every operational risk. Still, conversations with your CPA can help your leadership team understand significant operational, technology, and fraud-related changes that may affect financial reporting or warrant additional discussion with specialized advisors.

Consider a few questions that can help start a more meaningful conversation with your CPA and identify areas that may warrant additional attention:

• Have we changed membership, accounting, or point-of-sale systems?
• Have key finance or IT personnel departed or changed responsibilities?
• Have we seen suspicious payments, phishing attempts, or unusual transactions?
• Have new vendors gained access to financial systems or member data?
• If a key provider becomes unavailable, could club operations continue?

Four Risks Every Private Club Leadership Team Should Discuss

1. Payment fraud: Would we catch a convincing impersonation?

A familiar supplier emails new banking instructions for an actual invoice. Would the accounting team validate the request through a known point of contact before taking action? The FBI describes how business email compromise exploits trusted identities to redirect funds.

Question for club leadership: Are vendor changes independently verified, and are payment initiation, approval and reconciliation appropriately separated?

2. Member information: Do we know who has access?

Membership platforms, payroll providers, and payment processors may hold sensitive information. Clubs should understand data flows, vendor responsibilities and applicable payment-card obligations. The FTC’s cybersecurity guidance offers practical steps for protecting sensitive information, while the PCI Security Standards Council’s merchant resources help organizations understand their payment security responsibilities.

Question for club leadership: Do we know where member and payment information is stored, which vendors can access it and who is responsible for protection?

3. Continuity: Could your club operate during an outage?

Multifactor authentication, backups, and incident planning are practical safeguards that help clubs prepare for disruptions. CISA’s guidance on multifactor authentication explains how MFA helps protect access to systems and accounts, while the FTC’s cybersecurity resources offer additional guidance on preparing for and responding to cyber incidents.

Question for club leadership: If reservations, point-of-sale or accounting systems were unavailable during a peak weekend, who would act and how would essential services continue?

4. Governance: Is cybersecurity part of your leadership discussions?

Cybersecurity often falls between IT, finance, and operations. Gaps in accountability and ongoing oversight can allow emerging risks to remain unnoticed. Effective cybersecurity oversight starts with leadership having visibility into the organization’s most significant risks, emerging incidents, and the steps being taken to mitigate them.

Question for club leadership: Who receives cybersecurity updates, and how frequently does leadership discuss technology and fraud risks?

Turn Risk Awareness Into Action

Knowing the right questions is a starting point. Knowing which risks need attention and who is responsible for addressing them is what turns the conversation into action.

To help your club move from awareness to action, PBMares developed the Private Club Risk Readiness Checklist, a resource designed to help club leaders identify and discuss potential cybersecurity, fraud and financial control risks. 

The checklist covers six areas: payment fraud, financial controls, member information, technology access, incident preparedness, and governance oversight. It also provides space to document follow-up actions, responsible owners, and target dates.

The checklist is a discussion aid, not a cybersecurity assessment, fraud examination, or substitute for a financial statement audit.

Conversations with Your CPA Shouldn’t End With the Financial Statements

Your club’s financial statements tell an important part of your story, but they don’t capture every risk that could affect operations, finances, or members. Conversations about what’s changed, from new technology and vendors to emerging fraud threats, can help your leadership team recognize where additional attention may be needed.

Your CPA can help you connect those concerns to broader business risks and determine where additional expertise or a more focused assessment may be valuable.

PBMares works with private clubs and hospitality organizations across financial statement assurance, cybersecurity, IT risk, fraud and internal controls. Our team can help you better understand emerging risks, prioritize areas that warrant attention, and explore practical next steps based on your club’s needs.

Wondering how prepared your club is for today’s fraud and cybersecurity risks?

Start by downloading the Private Club Risk Readiness Checklist to identify potential gaps, surface overlooked concerns and guide more productive conversations among club leadership, management and your CPA. Bring the results to your next leadership discussion and connect with PBMares’ Hospitality Industry Team to explore whether any concerns warrant a more focused evaluation.

Start by downloading the Private Club Risk Readiness Checklist to identify potential gaps, surface overlooked concerns and guide more productive conversations among club leadership, management and your CPA. Bring the results to your next leadership discussion and connect with Antonina McAvoy, Partner, Cyber & Risk Advisory, or Robert Parker, Partner and Hospitality Team Member, to explore practical next steps based on your club’s specific risks and priorities.