What are the opening hours?

Wednesday 10am - 6pm Thursday 10am - 6pm

https://sphereindustries.com.au/

Sphere Industries, 2/52 Grace Street, Herberton (2026)

18/08/2026

Sphere Industries is Back Open! 🖥️✨
We are excited to let everyone know that Sphere Industries is officially back from our break and our shop at 2/52 Grace St, Herberton is open again from Wednesday 19th August after 10am.

Whether you need computer repairs, upgrades, or technical support, we are ready to help you out! Come on in or get in touch!

28/07/2026

Gone Fishing! 🐟
(Don't worry, we're still taking appointments!)

The shop is taking a short break from Tuesday 28th July and will reopen Wednesday 19th August.

Need a Home or Business Visit? We’re available by appointment!

Reach out to book:
- Call or Text: 0480 298 839
- Email: [email protected]
- Send us a message on Facebook
- Or use the QR code on our shop front to book an appointment.

Please note: While we may be in store, we won't be accepting any walk-ins during this time without a prior approved and confirmed appointment. We apologise for any inconvenience.

09/07/2026

❗ ALERT ❗ Australian websites are facing increased cyber threats, with many small-to-medium business impacted. ⚠️

We are aware of malicious cyber actors targeting website content management systems (CMS). If affected, malicious cyber actors could gain control of your website.

Website owners are encouraged to take immediate action to protect their website and check whether they have been impacted, using the advice in our full alert below.

If a service provider maintains your website, point them to this alert and review our guidance at the below link for additional questions to ask.

For the full alert and take additional steps to protect your websites, visit 👉 https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/large-scale-exploitation-campaign-targeting-website-content-management-systems-cms

30/06/2026

🔒 Day 20: The No-Blame Culture (The Power of Stepping Up)

We have covered a massive amount of technical and operational territory over the last three weeks. But at the end of the day, the absolute perimeter of your security isn't a piece of software—it’s the human beings running the computers.

And human beings make mistakes.

Imagine one of your administrative staff or a family member is rushing on a Friday afternoon. They are tired, they are distracted, and they accidentally click a link in a weird email. A strange window flashes on their screen for a second, then vanishes.
What happens next in that exact moment determines whether your business survives or gets completely wiped out by ransomware.

If your staff or family are terrified of being yelled at, shamed, or fired for making a digital mistake, they will do the most human thing possible: they will hide it. They will close the window, say nothing, and hope it goes away. Meanwhile, the malware silently spreads through your network for the next 48 hours.

Here is why a strict, corporate "blame culture" is a hacker's best friend, and how to fix it:

1. The Cost of Hidden Mistakes

In cyber security, time is your absolute most valuable resource. When a malicious link is clicked or a password is accidentally typed into a fake login page, there is a golden window of about 15 minutes where the damage can be almost completely contained.

If an IT provider or a tech-savvy business owner is notified immediately, they can isolate that specific computer from the network, revoke the compromised user account credentials, and kill the threat before it can pivot to your servers or shared cloud drives.

But if an employee hides the mistake out of fear of punishment, that 15-minute window slams shut. The hackers get all weekend to move laterally through your systems, disable your local data backups, and install network-wide encryption tools. By Monday morning, your entire operation is locked down with a massive ransom demand.

2. Shifting the Focus from Fear to Speed

Most traditional security training relies heavily on fear. Businesses tell staff: "Don't click links, don't be stupid, or you will breach policy." This approach completely fails because modern phishing attacks are incredibly sophisticated and designed to trick smart people.

To build a resilient operation, you must transform your workspace or household into a No-Blame Culture. The primary goal is simple: speed of reporting matters infinitely more than the mistake itself.

You want your team to know that they will never be penalized for reporting a suspected security slip, even if it turns out to be a false alarm. You want them to feel like an active part of the defense team, not potential criminals waiting to be caught out.

🛠️ What you can do today:

You can fundamentally change the security posture of your organization or home today by having a straightforward conversation and establishing three ground rules:

1. Issue the No-Blame Mandate: Gather your staff or sit down with your family today and say these exact words: "If you ever click a link you shouldn't have, if you see a weird screen pop-up, or if you think you accidentally typed a password into the wrong place—I will not be angry, and you will not be in trouble. I just need you to tell me immediately so we can protect our data together."
2. Establish the 15-Minute Rule: Make it clear that the only real failure is silence. Implement a simple policy: if something goes wrong, report it within 15 minutes. Normalize the phrase "I think I might have clicked something weird" as a standard, everyday piece of operational communication.
3. Run a Positive-Reinforcement Test: The next time an employee or family member brings you a suspicious email or admits they made a minor mistake, don't sigh or roll your eyes. Thank them directly for their vigilance. When people see that reporting a threat leads to praise and quick teamwork rather than a lecture, they will keep doing it.

By removing the fear of shame, you turn your entire team into a human radar system that catches threats long before they can ever reach your bank balance.

See you tomorrow morning for Day 21—the final day of our series—where we put everything together and build "The Fire Drill": a simple, 1-page incident response roadmap so you know exactly who to call and what to physically unplug the second a breach actually happens.

29/06/2026

🔒 Day 19: The "Out of Office" Exposure (Oversharing Your Blueprint)

We all know the value of marketing. If you run a local business or provide a service across the region, you need a digital presence. You post updates on Facebook, celebrate milestones on LinkedIn, share photos of your team at work, and put up automated email responses when you travel so your clients know you haven't vanished.

But here is a sobering reality check: hackers read your social media updates and out-of-office emails far more closely than your customers do.

This vulnerability is called Open Source Intelligence (OSINT) gathering. It means a cyber criminal doesn't need to break through a firewall to learn about your company structure—they just look at what you are voluntarily broadcasting to the public and use it to build a flawless, highly targeted scam.

Here is how simple, well-meaning posts turn into weaponized ammunition for hackers, and how to tighten your public profile:

1. The Automated Roadmap (The Out-of-Office Email)

Imagine you are heading away for a week's holiday or traveling down south for an industry conference. You set up a standard out-of-office auto-reply on your business email:

"Hi there, I am currently out of the office attending the Regional Construction Conference until next Friday with no access to phone calls. For urgent billing or account enquiries, please contact our administrative assistant, Sarah, at [email protected] or call her on her direct line."

To a client, that’s helpful customer service. To a hacker, that is gold dust.

The criminal now knows:
- You are completely uncontactable by phone.
- The exact name and email address of the person who handles your business money (Sarah).
- The specific industry jargon, dates, and event you are currently attending.

The hacker will immediately pivot. They will email Sarah, pretending to be you writing from a personal account because your work phone has no reception. They will write: "Hey Sarah, I'm stuck at this conference registry desk and they won't let our team in until this venue deposit is paid. I know I'm out of pocket, but can you urgently wire $3,400 to this account right now? I'll look over the paperwork when I get back next Friday." Under pressure to help their boss, Sarah processes the payment.

2. The Social Media Org Chart

Look at your company's page or team photos. Did you post a cheerful picture celebrating "Welcome to the team, Dave, our new junior purchasing officer!" or a LinkedIn update congratulating a supplier?

Cyber criminals use these public posts to map out your entire internal staff hierarchy. They learn exactly who has the power to sign off on orders, who is brand new to the company (and therefore less likely to question a weird request from a manager), and who your trusted third-party business partners are. They use these real names and real relationships to craft the precision phishing emails that target specific people in your team.

🛠️ What you can do today:

You don’t need to completely delete your social media accounts or stop marketing your business. You just need to implement a strict "Information Diet" for your public communications:

1. Vague Up Your Out-of-Office Replies: Stop giving away specific details in your automated emails. Never list specific dates, exact locations, or name specific internal staff members and their direct phone lines. Instead, use a generic, secure template:
"Thank you for your email. I am currently away from my desk with limited access to messages. If your request is urgent, please call our main office number at [Insert General Office Line] or email our general enquiries desk at [Insert info@ business address], and our team will direct your query."
2. The 24-Hour Delay Rule for Personal Travel: If you are traveling for business or holiday, never post photos or updates on personal social media accounts while you are actively away. Wait until you have returned home and your office door is locked before uploading your travel summaries. Showing criminals an empty house or an empty office desk in real-time is an open invitation.
3. Audit Your Staff Details: Review your public "About Us" pages or corporate social media profiles. Avoid publishing direct email addresses or individual phone lines for sensitive roles like accounts payable, payroll, or administration. Use generic shared inboxes (like [email protected]) that are monitored by multiple eyes, making it much harder for a hacker to isolate and trick a single worker.

By masking the inner operational machinery of your business, you deny hackers the puzzle pieces they need to build a believable trap around your staff.

See you tomorrow morning for Day 20, where we look at "The No-Blame Culture"—and why creating an environment where staff are too terrified to admit they clicked a bad link is the fastest way to get your entire business network encrypted by ransomware.

27/06/2026

🔒 Day 18: Browser Hygiene (The Spies inside Your Internet Browser)

Think about the software tool you use more than anything else during your working day. It’s almost certainly your web browser—whether you use Google Chrome, Microsoft Edge, Safari, or Firefox.

Because we do everything inside the browser, from Xero accounting and internet banking to checking emails and managing customer files, we like to customize it. We install tiny helper programs called browser extensions (or add-ons) to make life easier. Maybe it’s a free tool to block annoying YouTube ads, a coupon finder that hunts for discounts when shopping, a grammar checker, or a colorful custom screen background.
They seem completely harmless. But behind the scenes, browser extensions are one of the most unmonitored and heavily targeted vectors for silent corporate espionage.

Here is why your browser add-ons might be secretly recording every single thing you type, and how to clean out the junk:

1. The Power of Absolute Visibility

When you install a browser extension, a little pop-up box appears asking for permissions. It almost always contains a sentence like this: "This extension can read and change all your data on all the websites you visit."

Because we just want the tool to work, we click "Allow" without thinking.

But think about what that actually means. If an extension can read and change everything on your screen, it means the second you log into your business bank account, your supplier portal, or your email, that extension can see exactly what you are typing. It can record your keystrokes, intercept passwords before they are encrypted, scrape the credit card details you type into a checkout page, and log your customers' private data.

2. The "Extension Bait-and-Switch" Scam

You might think, "I only download highly rated, legitimate extensions, so I'm completely safe."

Unfortunately, cyber criminals have figured out a brilliant, sneaky way to bypass your caution. They find a popular, completely legitimate free extension that has been built by an independent developer and has hundreds of thousands of happy users. The criminals will approach that developer and offer to buy the extension from them for a large sum of cash.

The developer takes the money and hands over the keys. The criminals then push out a silent, automatic background update to all existing users. Overnight, that innocent ad-blocker or grammar tool transforms into a malicious data-harvesting machine. You won't notice a thing, because the icon on your screen looks exactly the same, but it is now quietly beaming your private data back to a hacker's server.

🛠️ What you can do today:

It is time to run a strict operational audit on your web browser. This takes less than five minutes but closes a massive, active vulnerability.
1. Open your Extension Manager:
If you use Google Chrome, click the three vertical dots in the top-right corner, go to Extensions, and click Manage Extensions.
If you use Microsoft Edge, click the three horizontal dots in the top-right corner and select Extensions.
If you use Firefox, click the three lines in the top right and select Add-ons and themes.
2. Run an Aggressive Cull: Look closely at every single item listed. If you see an extension that you don’t recognize, haven’t used in the last three months, or that was downloaded for a one-off task, click "Remove" or "Delete" immediately. Do not leave them sitting there disabled.
3. Check for "Developer Warnings": Modern browsers like Chrome and Edge have recently started auditing their extension stores more aggressively. If an extension you are running has been flagged as malicious or removed from the official store by Google or Microsoft, a warning message will appear next to it in your settings. If you see any warning, delete it instantly.
4. Adopt a "Less is Best" Policy: Moving forward, treat browser extensions like dangerous software. Only install tools from massive, trusted institutions (like verified password managers). If you need a utility tool like a calculator or a unit converter, use a standard bookmarked website instead of installing an extension that demands access to your entire digital life.

By keeping your web browser clean, lean, and unburdened by third-party tracking code, you ensure your primary window to the internet remains a secure vault.

See you tomorrow morning for Day 19, where we look at "The 'Out of Office' Exposure"—and how oversharing simple operational details on social media hands hackers the perfect ammunition for targeted corporate scams.

26/06/2026

🔒 Day 17: The Shared Document Trap (The Fake OneDrive Portal)

Yesterday, we looked at how hackers buy their way to the top of Google and Bing, using fake "Sponsored" ads to trick us into clicking cloned websites. But today, we are looking at a completely different kind of digital trap—one that bypasses search bars entirely and lands straight in your daily workflow by exploiting something you do dozens of times a week: opening a shared link.

Because local businesses have largely ditched physical USB drives, cloud sharing platforms like Microsoft OneDrive, SharePoint, and Google Drive have taken over. We trust them implicitly.

Cyber criminals know this, which is why they now use The Shared Document Trap as their primary shortcut straight into your business.

Here is how a single click on a fake cloud link completely bypasses yesterday’s network security walls and strips away your data:

1. The Urgent Shared File Notification

You receive an email that looks entirely legitimate. It might pretend to be from a real real estate agency, a regular local supplier, or a commercial client. The email simply says: "Hi there, I’ve uploaded the updated project specifications and floor plans to our corporate SharePoint folder. Please review the attached link so we can finalize the contract this afternoon."

There is no attached file to trigger an email virus scanner. There is just a clean, professional-looking button that says "View Document."
Because your business works in the cloud every day, you click the button.

2. The Flawless Login Fakeout

The link takes you to a webpage that looks exactly like the official Microsoft 365 or Google Workspace login screen. It features the correct branding, the exact fonts, and even the reassuring security layout you see every morning. A box pops up saying: "For security purposes, please log in with your business email credentials to view this secured document."

In a rush to see the file, you type your email address and your master password.

The moment you hit enter, the screen might briefly glitch or redirect you to a generic corporate homepage. You think to yourself, "That’s weird, the link must be broken," and you close the tab.

But you didn't actually log into Microsoft. You just typed your master corporate credentials directly into a criminal’s harvesting database.

3. Bypassing Yesterday's Walls

This is where we connect back to the network quarantine we built yesterday. On Day 16, we carefully isolated your smart cameras, printers, and IoT gadgets onto a separate Guest Network so they couldn't talk to your main business computers. We did this because hackers love to use those cheap devices as a "bridgehead" to pivot onto your primary machines.

But by clicking that fake cloud link and voluntarily typing your password into that fake portal, you have handed the hacker an express ticket straight past the gate.

The malicious actor doesn’t need to try and hop across your Wi-Fi routers or exploit a smart TV—you have just handed them the master key to your live corporate cloud environment. From anywhere in the world, they can now log into your real Microsoft 365 account, read your sensitive emails, download your entire customer database, and begin the invoice manipulation scams we warned you about on Day 15.

🛠️ What you can do today:

To defeat a cloud portal fakeout, you need to add one critical habit to your daily browsing routine: The Address Bar Check.
1. Look at the URL Absolute Domain: Before you ever type a password into a screen that asks you to log in to view a document, look at the very top of your web browser. If it is a real Microsoft login page, the address MUST end exactly in login.microsoftonline.com or live.com. If it says anything else—like microsoft-secure-login-shared-docs.xyz or verification-portal-auth.net—it is a 100% guaranteed scam. Close the tab immediately.
2. Verify the Share Request: If you receive an unexpected shared document link from a client or supplier out of the blue, pick up the phone or send a separate text message to confirm they actually sent it. Hackers frequently take over legitimate business email accounts and blast out these fake OneDrive links to the victim's entire contact list.
3. Turn on Multi-Factor Authentication (MFA): This is your ultimate safety net. If you accidentally fall for a fake login screen and hand over your password, a hacker still cannot log into your real account from their offshore computer unless they also have the live security code from your mobile authenticator app.

By taking two seconds to look at the web address before typing a password, you completely neutralize the smartest trick in the modern hacker's playbook.

See you tomorrow morning for Day 18, where we look at "Browser Hygiene"—and why those innocent little ad-blockers, coupon finders, and helper add-ons might be acting as silent spies inside your screen.

25/06/2026

🔒 Day 16: The Search Engine Ad Trap (The Sponsored Link Scam)

When you need to visit a website or download a piece of software for work, how do you get there? If you are like most people, you don't type the exact web address into the top bar. You open Google or Bing, type something like "Xero login," "Zoom download," or "MyGov," and click the very first link that pops up.

We do this because we implicitly trust search engines to filter out the bad guys.
But cyber criminals have figured out a brilliant, legal way to cut straight to the front of the queue: they buy advertising space.

By exploiting the automated ad systems on major search engines, hackers place malicious links at the absolute top of your search results. This is The Search Engine Ad Trap, and it is currently one of the fastest-growing entry points for malware worldwide.

Here is how typing a simple phrase into Google can hand a criminal total control of your computer before you even realize you've clicked the wrong page:

1. Bidding for the Top Spot

When you search for a popular business tool, the top two or three results on your screen are almost always marked with a tiny, bold tag that says "Sponsored" or "Ad."

Hackers set up fake business accounts and place bids on common keywords like "Download VLC Player" or "QuickBooks login." Because the search engine's ad platform is entirely automated, the criminal's ad is approved and published instantly. The link looks entirely genuine—it will feature the real company's logo, use their actual business name in the headline, and appear to be exactly what you are looking for.

2. The Cloned Software Trap

The moment an administrative worker or family member clicks that top "Sponsored" link, they aren't taken to the real website. They are redirected to a flawless replica site built by the hackers.

If you were trying to download a program like Zoom or Adobe, the fake page will feature a massive, friendly button that says "Download Now."

When you click it, you don't get the software. Instead, a compressed bundle of malicious code downloads to your machine. Because you intended to download a program, you happily click "Run" or "Install" when the computer prompts you. Within seconds, the hidden malware has bypassed your local defenses, dropped a background backdoor, and begun scanning your system for accounting files and saved passwords.

3. The Credential Harvest

This trap is equally deadly for logging into existing accounts. If you search for your bank portal or accounting software and click a sponsored hacker link, the fake page will display a standard login box.

You type your master username and password. The screen will display a brief "system error, please try again" message and quietly redirect you back to the real login page. You type your password a second time, log in successfully, and assume it was just a minor internet glitch. But the hacker already has your master corporate credentials stashed in their database, waiting to be used.

🛠️ What you can do today:

You cannot rely on search engines to police their own advertisements. To protect your computers from these sponsored traps, implement these three strict rules today:

1. Skip the "Sponsored" Section Entirely: Train your eyes to completely ignore the top two or three results marked as "Sponsored." Scroll past them until you reach the Organic Search Results lower down the page. Search engines vet organic links much more thoroughly, meaning the real, official website will almost always be the very first non-sponsored link you see.
2. Look for the Domain Visual Trap: Before clicking any download link, look closely at the text underneath the headline. Hackers use look-alike web addresses to trick your brain. For example, instead of the real zoom.us, the sponsored ad might lead to zoom-download-support.net or vlc-media-player-free.org. If the web address looks messy, convoluted, or ends in a strange extension (like .xyz, .cc, or .top), do not click it.
3. Bookmark Your Daily Portals: For the vital websites you use every single day to run your life or business—such as your internet banking, your email portal, and your accounting software—never search for them on Google. Navigate to the real website once, verify it is correct, and save it as a bookmark in your browser. From then on, only access those sensitive pages through your secure bookmark folder.

By teaching yourself and your team to scroll past the paid advertisements, you cut off a major digital pipeline that criminals use to slip malware straight into your network.

See you tomorrow morning for Day 17, where we look at "The Shared Document Trap"—and why clicking an innocent-looking link to view a shared cloud contract or quote is the ultimate shortcut for data thieves.

24/06/2026

🔒 Day 15: The Business Email Compromise (The Invoice Hustle)

Imagine you have been working with a trusted local supplier or contractor for years. They finish a job for you, and an invoice arrives in your inbox exactly when you expect it. The email comes from the supplier's actual email address, features their correct logo, and references the exact work they just performed.

You process the payment of $8,500. A week later, the supplier calls asking why they haven't been paid yet. You trace the transfer, only to discover the money is completely gone—moved through a network of bank accounts and bounced offshore within minutes.

This is Business Email Compromise (BEC), often called invoice manipulation. It is currently the single most financially damaging cyber crime hitting small businesses and contractors across Australia.

Here is how criminals intercept your cash flow without ever breaking into your actual office:

1. The Silent Swap

Many people think a compromised invoice will always come with a polite little warning note at the bottom saying, "Please note our bank details have changed."
It won't. Hackers have moved past that. Because they know warning notes raise red flags, they usually say absolutely nothing.

Once a hacker breaks into a business email account, they sit there silently and use automated rules to watch the outbound mail. The second a legitimate invoice PDF is attached to an email, the hacker intercepts it in mid-air. They use basic editing tools to cleanly swap out the genuine BSB and account numbers with their own fraudulent ones. The text of the email remains entirely normal. Because the invoice looks identical to last month's bill and arrives exactly when expected, you pay it without a second thought.

2. PDFs are Not Just "Paper"

This brings us to one of our absolute biggest cyber threats over the last couple of years: the PDF attachment itself.

Most people treat a PDF as a completely harmless digital image. In reality, a PDF is a complex bundle of code. Sophisticated hackers figured out how to inject hidden, malicious software scripts deep inside the layout layers of a standard invoice file.
When you double-click that invoice attachment to view it, the file exploits a structural weakness in older PDF readers to silently execute code in the background. Before the document even loads on your screen, the hidden malware has already disabled your local defenses, dropped a persistent backdoor, and given the hacker full view of your machine. It has taken a massive wave of urgent software security patches recently for the major tech companies to finally get a grip on this threat and close the gap—meaning if you haven't updated your PDF software recently, you are completely exposed.

🛠️ What you can do today:

You cannot rely on standard email filters to spot a modified account number or a hidden PDF payload. You must enforce these strict, unbendable rules in your business today:

1. The Verbal Verification Rule is absolute: If you receive an invoice from any supplier, contractor, or partner, you must manually check the BSB and account numbers against a verified record (like the details you used for their very first payment). If the numbers do not match perfectly, do not pay it. Pick up the phone and verbally confirm the numbers with them.
2. Avoid using the contact info on the invoice: If a hacker has intercepted an email and modified the banking layout on a PDF, they have also altered the phone number and email address listed at the bottom of the page. If you call that number to verify, the criminal will answer the phone and happily confirm their fraudulent bank details. Always find the supplier's phone number independently—use a physical address book, look at their official website, or pull up an old printed statement from a year ago.
3. Scan with your Anti-Virus Software: This is exactly where the trap we discussed on Day 1 turns deadly. If an employee double-clicks one of these poisoned PDF invoices while your machine is running an expired, paralysed third-party anti-virus trial, the hidden script inside the document will face absolutely zero resistance. It will slide straight past your dead defenses and take over the machine. Ensure your protective shield is active—either pay for your subscription or completely remove it to let the built-in Windows Defender wake up and protect your files.
4. Kill the outdated PDF readers: Because hidden PDF malware has been running rampant, you must ensure your document viewers are completely up to date. Open your PDF viewer (like Adobe Acrobat Reader), click on the Help menu at the top, and click "Check for Updates." Better yet, change your system defaults so your computer opens PDFs inside a modern web browser like Microsoft Edge or Google Chrome, which have much stronger sandboxing security built in to stop malicious scripts from jumping onto your hard drive.

Taking an extra 60 seconds to verbally confirm an account number before hitting "transfer" is the only bulletproof way to ensure your business cash flow doesn't fund a cyber criminal's next vacation.

See you tomorrow morning for Day 16: The Search Engine Ad Trap (The Sponsored Link Scam). We will reveal how cyber criminals are buying their way to the very top of Google and Bing search results, turning a routine web search into a direct trap designed to steal your company logins.

Sphere Industries

18/08/2026

28/07/2026

09/07/2026

30/06/2026

29/06/2026

27/06/2026

26/06/2026

25/06/2026

24/06/2026

Address

Opening Hours

Telephone

Website

Alerts

Contact The Business

Shortcuts

Share

Category

Listing takedown request