Back up offline is not available v2026.5

What is frustrating is that MYOB continually makes changes without asking the Members if the majority of them want it, or dont want it and give customisable options for those that don't.  The online payments feature should have been an option you could turn on IF you want it (not automatically turning on without consent) and the Offline Backup option being removed is beyond disappointing. I feel that is possibly so you can feather your own nest financially if a Backup needs to be restored, so it can only be done by you and charged to do so ?  I could go on but I wont.  MYOB, consider all the users, not a minority and give options to customise to suit each business. Changes should be what Users want, not what suits you, or you "think" they want.

A customer for almost 30 years and some of the changes you have made without taking into consideration how it will affect many Businesses is in my opinion, very unprofessional. 

Hi dirkfielding​ , creating a case with the security team will provide a fast turnaround for your concerns.
Calling to our support team and creating a support case, unfortunately means that you enter the queue with everyone else (and these are taking a lot longer than normal right now) but we create the option to report security concerns to ensure that you have an avenue for getting something like this addressed quickly.

Thank you The_Doc​ for you replies, I think you have articulated the scenarios and considerations that people need to be aware of before assuming that MYOB are at fault. 
 

Hey Doc The_Doc​ 

Fair point here, and definitely worth exploring a little further.

ISO 27001 is, as you mentioned, risk-based — it doesn't mandate a specific architecture, so "no offline backup" can sit in a risk register as an accepted risk, if formally assessed with documented rationale and compensating controls. 

But I think that strengthens the case against MYOB's actions here.

This isn't a pre-existing gap — it's a control that was withdrawn. Many chose MYOB because local backup existed and was built into the risk treatment plan. Removing it doesn't put MYOB on equal footing with a cloud-only competitor.

That platform also has third-party options — restorable backups via an independent provider — so the risk is mitigated outside the platform itself. MYOB removing local backup with no equivalent third-party path (that I have been able to find, at least) leaves us worse off than the example being used to defend it.

Mike_MYOB​ 

I'd really like you to hear what I'm saying here.  And I'd also like you to understand what's actually happening - your customers felt that the offline backup was a huge positive to using MYOB over the competition, and are extremely upset that it has been taken away.  And the timing of this change, right before EOFY, was just a terrible, terrible choice on MYOB's behalf, warning or not.  

Hi KatieLee​ 

This is good stuff and just the logical summary needed for the argument to pushed back onto MYOB.

However, there is a slight spoiler to your argument that MYOB will exploit - a big online only accounting software provider does not any ability to back up your data, recover your data, restore your data or do anything that suggests that some sort of back up has been done for businesses using it and their clients (assuming an accounting business has both MYOB and competitor software user clients) - this becomes a huge problem.

We are fully ISO accredited 27001, DOC2, and numerous other ISO accreditation and we use this competing software, (though we are not an accounting firm)  but a cloud hosting business specialising in medical practices, but not exclusively.

There seems to be a grey area where, if a back up is not available ( either you don't use this software) or it is risk factor to be managed in the assessment.

The Doc

Hi Mike_MYOB​ 

I'd like to address this part of your reply - from my perspective as an Information Security Management Systems auditor - 

• Big companies need to have a running backup taken off premises.
  • Are you able to share any more supporting information around this? To my knowledge most/all of our competitors don't offer an offline backup, so I would like to take a further look at this mandatory rule and how it applies.
    I would assume that MYOB hosting the online backup will be considered a back up that is not held on premise for that business.

There's an important distinction between offsite and offline backup, and MYOB hosting our backup in the cloud only satisfies the former.

• Offsite just means the data is stored somewhere geographically separate — it protects against a local disaster (fire, flood, hardware failure at our premises).
• Offline (or air-gapped/immutable) means the backup has no live network connection to production systems, so it can't be reached, encrypted, or deleted if ransomware compromises our environment or the platform it's connected to.

MYOB's hosted backup is always-on and logically connected via our authenticated account. If our MYOB access or the platform itself were compromised, that backup is potentially in the blast radius too — it doesn't give us a genuinely isolated recovery point.

This isn't just a nice-to-have. It's a specific, named requirement under the frameworks Australian businesses are increasingly being assessed against:

ISO 27001:2022 — Information Backup — audit guidance under this control treats "backups logically connected to production with no immutable protection" as a fail condition, separate from whether the copy is geographically offsite. Standard guidance explicitly recommends a full backup kept offline (external drive or NAS, disconnected after each run) specifically because "if the drive stays online and accessible, malware can still infect those files."

SMB1001:2026 — backup and recovery is one of five assessed domains, and air-gapped/immutable backup strategies are a named requirement at the higher certification tiers (Gold and above). Relying solely on a vendor's built-in retention isn't treated as an equivalent control.

By removing the ability to take a local/offline backup, MYOB isn't just removing a convenience feature — it's removing our ability to meet a documented control that our clients, insurers, and auditors are actively checking for. "We back it up too" doesn't close that gap, because it's the same connected environment being relied on twice, not an independent recovery point.

Could you clarify whether there's any roadmap to reinstate an offline/exportable backup option, even as a manual or scheduled export rather than a live sync? For businesses pursuing ISO 27001 or SMB1001 certification, this isn't optional.

To this end, we also back up our Microsoft environment, and all other business critical information, with daily immutable backups.  And so, I will repeat my earlier point - Relying solely on a vendor's built-in retention isn't treated as an equivalent control.

I month. No response. 3 hour wait on phone before giving up. I’ll try again tomorrow. If this is not the right forum I will not bother you anymore 

thank you

Hi dirkfielding​ 

It isn't that I am doubting the authenticity of your claim - I have made that clear - it is just that I am arguing that your claim has to be handled off this forum and not in the context of the fight this post is about.

Undoubtedly dirkfielding​ you have a stack of evidence supporting your claim which throws the gauntlet squarely down in MYOB's court to escalate this complaint, case through the correct channel - and the public forum is not that forum - for a number of reasons notwithstanding private information on both sides needs to be collected and MYOB cannot do that on this public forum despite wanting to add context to this issue.

All I am saying is - find the right person in MYOB to grab this case and get it sorted - by all means when it is completed and we assume, you get your file back - air the grievance ... that is your right.

We cannot be party to this due diligence required to sort this problem objectively - there is too much emotion spilt on this forum for debating this issue.

But further, as I keep saying - the debate ( the core of this post - local back-ups and opening files locally) is not helped  by public airing your case, sorry.

I am 73 and been in business over the entire MYOB life cycle - the forum is where we often see complaints for the first time and the forum respond in kindness mostly and MYOB gets a hammering if they have erred.

Now to actually give a good story of how quickly, in general MYOB handles problems - on Friday 1 week ago a clients franchise file went off the air - this client runs 20 plus MYOB files - all on line and accessed by a bevy of in house admin/accounting staff - I have full administration rights to all and have 3 operating apps connecting every 30 minutes via the API to all these files - one went dead with an error message in my app - 'Access Denied' - I was the first in the system to see the problem then the admin staff reacted sending a 'help - Doc file gone dead'.  Wasn't my file and not my job but I leapt in and rang MYOB - it was 1630 late friday .... yes I was put on hold for 25 minutes - 4th in line.

When a technician came on the resolution of the problem was efficient, smart, professional and the problem after the first respondent operator clearly identified that I knew there was a problem and the file had crashed - quickly escalated the case up the line but asked me to hold whilst the problem was  resolved.

He came back on a few times to say the problem is being addressed please hold. Polite, knowledgeable and proactive.

Within about 20 mins the file was back online and the problem has not recurred - the telephone call was politely summarised, 'the cause of the crash will be investigated - anything else I can help you with?' - no thank you, most aprreciated.

My point - get the right person in MYOB and cases can be resolved quickly - however it needs to be said - get the wrong person ( which may be the result of a big turnover in MYOB of phone operators) and your case will stagnate.

dirkfielding​ , push this hard and find the right person and MYOB must resolve it quickly. 

We would certainly like to hear the outcome.

The Doc

Keep up your serious breach issue with MYOB and call it 'as it is'.

Unfortunately, you will have to call and stay on hold for hours until someone answers the phone and then hope that this person can help, usually not and you will be transferred to another dept/person and put back into the queue for another long while.  

MYOB needs to do better training & also, give other numbers to call for a more precise inquiry to the correct dept/person.  NOT GOOD ENOUGH!

MYOB - Re-instate OFFLINE Backups

The Doc. As time will tell, it has gone wrong. If anyone is serious I’m handing you not how it could go wrong but how it has gone wrong. 

I understand you doubting me because it’s unlikely to happen but it has. MYOB gave my company file and administration rights to a person that conned them into doing so. If my book keeper MYOB certified, had made backups to her system we would get through this while MYOB figured out what went wrong. 
I can send anyone the evidence, I’ve continually sent it to MYOB. It’s not that they have dismissed the complaint it’s that they have not responded at all.

if anyone can help me actually speak with someone at MYOB it would be appreciated. I’m 64, been in business over 40 years

Hi dirkfielding​ 

We on this forum hear about issues like this and our experiences over the years resonate to awful situations like this...... we really understand.

Having said that, and now I am putting on my Devil's Advocate hat, we have to be careful in assuming that the perpetrator, MYOB, was to blame or at fault - we do not have the full text of the argument for both sides.

I have been a user, Certified Consultant partner for a long time - I am also a developer and from the perspective of security and getting data out of a clients file, or posting it - the security is ultra tight, with further security being added 1 Sept 26.

As for breaches from the front end and people being locked out of their file - the lock outs happen, a lot, but getting into someone's - it has happened I believe and supplier bank accounts were changed to send money to other than the supplier - that actually was before 2FA or MFA became mandatory - but the action by MYOB to fix this was rapid. 

Has MYOB had a data breach, yes - type MYOB data breach into Google and a payroll incident comes up in 2019 - 7 years ago - but it was handled and fixed rapidly....... and in security terms 2019 was a whole different end game than 2026.

So, what am I dribbling on about .... far comment and I take that on the chin because I am not trying to say whether MYOB is at fault or not - there is always context and as the saying goes ' many a horse thief were hanged on circumstantial evidence' - i.e. the aggrieved were hasty in their judgement and that is my point...

We cannot win this argument by posting negative comments (hastily or otherwise) - forgive me dirkfielding​ I am not saying your event is of little impact - we hear you, we get angry with MYOB for you, we would like this fixed for you (and Mike_MYOB​  has given you a pathway forward to take this complaint) ... what I am saying is please focus on the issue of MYOB we don't want you to do our back-ups - (whether for trust reasons or not) - but we have our own business rules to apply, not your business rules; please give us back a feature that is irreplaceable no matter how much lipstick you apply. 

Whether we trust you or not is not relevant, actually, some users don't, I don't - not because you can't be trusted, but because the business rules we chose as an Australian business reporting to ATO, ISO accreditation, our clients (if publicaly listed) dictate how we backup data - and that MYOB is our democratic right.

Once again, dirkfielding​, my apology if I appear to be deflecting from your serious event - I am not - all I am saying is that if we are to win this argument fairly, we must offer up bona fide evidence to support our argument, and should we dip below this minimum standard MYOB will simply not be held accountable for this appalling, untimely change.

For your bad timing of rolling out this change, MYOB, that is not in debate - the jury has long ago passed judgement. Ironically, for you MYOB, the timing suggests poor judgement is in this mix.

Please, please listen to the shrill cries from your army of users, developers, accountants, bookkeepers, etc - we do not need you to look after our backups - it can only go wrong as time will tell.

The Doc