Perimeter breach detected 5 May 2026 targeting a WA-based Pronto ERP cloud hosting environment used by the mining sector. Forensic analysis confirmed client production environments were not accessed; exfiltration was limited to Scope's internal file server. Client configurations restored from backups by 18 May. ACSC and OAIC notified.