INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Australian Cyber Threat Report 2025-26 Reveals 20% Increase in Incidents

| 2026-10-27 12:48 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
In the 2025-26 financial year, Australia's cyber security authority responded to a significant increase in cyber incidents, with 1,524 reported cases, representing a 20% rise from the previous year and a 36% increase over five years. The Australian Signals Directorate's Australian Cyber Security Centre issued more than 4,400 notifications about potential malicious activity during this period. Phishing, compromised accounts, unpatched systems, ransomware, and data theft remain major operational pressures, with identity fraud being the most frequently reported cybercrime category. Artificial intelligence has increased the speed and scale of many established techniques, highlighting the need for organisations to patch faster, protect identities, improve logging, manage supplier access, and prepare to continue operating during an incident.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity. • Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Shai-HuludShai-Hulud
Target & Sectors
FIVE_EYES FIVE_EYES governmentgovernment healthhealth
Incident Timeline
‎2025/10/27
Cyber security incidents in Australia increased by 20% year over year, with a total of 1,524 reported incidents.
general_metric 20 %
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
general_metric 1,524 cyber security incidents
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
organisation Ransomware
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
tactic Data Breach
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
general_metric 2025 Measure
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
general_metric 80 %
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
general_metric 6 minutes
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
financial 139 Ransomware incidents
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
general_metric 98 year breach incidents
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
general_metric 66 %
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
general_metric 16 %
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
‎2025-26
Ransomware was one of the top 10 MITRE ATT&CK techniques observed in Australian cyber security incidents during the 2025-26 financial year.
target_region Australia
Australia’s Annual Cyber Threat Report 2025-26 Shows Cyber Incidents Up 20%.
Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years.
What Did Australia Record in 2025-26?
Prevalence of the top 10 MITRE ATT&CK techniques observed in Australian cyber security incidents during 2025-26.
general_metric 20 %
Australia’s Annual Cyber Threat Report 2025-26 Shows Cyber Incidents Up 20%.
Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years.
general_metric 1,524 cyber security incidents
Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years.
general_metric 36 %
Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years.
tactic Ransomware
Did Ransomware Increase in 2025-26?
general_metric 10 %
Prevalence of the top 10 MITRE ATT&CK techniques observed in Australian cyber security incidents during 2025-26.
‎2026/10/27
The Australian Signals Directorate's ACSC responded to 1,524 incidents in the 2025-26 year.
organisation Western Australia
Western Australia represented 12%, South Australia 7%, while the Northern Territory, Australian Capital Territory and Tasmania each accounted for 2%.
organisation the Northern Territory
Western Australia represented 12%, South Australia 7%, while the Northern Territory, Australian Capital Territory and Tasmania each accounted for 2%.
organisation Australian Capital Territory
Western Australia represented 12%, South Australia 7%, while the Northern Territory, Australian Capital Territory and Tasmania each accounted for 2%.
organisation Tasmania
Western Australia represented 12%, South Australia 7%, while the Northern Territory, Australian Capital Territory and Tasmania each accounted for 2%.
data_breach 2025 threat data
Australia’s 2025-26 threat data shows an environment moving faster without abandoning familiar weaknesses.
organisation The Australian Signals Directorate’s
It is the Australian Signals Directorate’s annual assessment of cyber threats affecting Australian individuals, businesses, government and critical infrastructure.
The Australian Signals Directorate’s Australian Cyber Security Centre also expanded proactive warning activity, issuing more than 4,400 notifications about potential malicious activity during the year.
organisation The Australian Cyber Security Hotline
The Australian Cyber Security Hotline received more than 37,500 calls, down 12% from the previous year.
organisation Health Care and Social Assistance
Health Care and Social Assistance was the leading non-government sector at 7%, while Manufacturing entered the top ten and recorded the largest increase in reports.
financial 139 Ransomware incidents
Why Did Flat Ransomware Volume Still Matter? ASD’s ACSC responded to 139 ransomware incidents , broadly consistent with the previous year.
organisation Why Did Flat Ransomware Volume
Why Did Flat Ransomware Volume Still Matter? ASD’s ACSC responded to 139 ransomware incidents , broadly consistent with the previous year.
organisation SonicWall
In a separate Akira ransomware investigation, reports from multiple organisations helped ASD’s ACSC connect activity to exploitation of a known SonicWall vulnerability.
organisation the Office of the Australian Information
ASD’s ACSC responded to 98 data breach incidents , up 66%, while the Office of the Australian Information Commissioner received 1,205 breach notifications during 2025, its highest annual total since the Notifiable Data Breaches scheme began.
organisation the Data Breach Trend
How Serious Was the Data Breach Trend? ASD’s ACSC responded to 98 data breach incidents, a 66% increase.
organisation ASD’s ACSC
Where Did Cyber Risk Concentrate? Federal government accounted for 32% of incidents reported to ASD’s ACSC, followed by state and local government at 16%.
organisation State
State-sponsored actors continued to seek sensitive information and access that could support later espionage or disruption.
organisation ASD
ASD’s ACSC identified 362 incidents after proactively warning organisations about suspicious activity, while more than half of its individual notifications originated from declassified intelligence.
organisation ReportCyber
How Much Did Cybercrime Cost Australians? More than 82,000 cybercrime reports were submitted through ReportCyber, or about one every six minutes.
organisation Which Attack Paths
Which Attack Paths Appeared Most Often?
infrastructure 1,000 vulnerable devices
ASD’s ACSC then identified almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable Australian organisations, many in critical infrastructure, and issued targeted warnings.
organisation How Quickly Are
How Quickly Are Vulnerabilities Being Exploited? Publicly reported common vulnerabilities and exposures (CVEs) increased 30%.
organisation cPanel
A collective notification about cPanel vulnerabilities was sent to 340 entities and resulted in more than 60 incidents being confirmed.
organisation Limit
Limit data exposure, enforce least privilege, validate outputs and retain human oversight for actions that affect systems or customers.
organisation Incident
What Is the Difference Between a Cybercrime Report, an Incident and a Notification?
organisation Cybersecurity Content Development Specialist
Amir Owda Amir Owda is a Cybersecurity Content Development Specialist at SOCRadar.
financial 33,000 individuals
The average self-reported cost for individuals remained A$33,000.
The average self-reported cost was A$33,000 for individuals and A$93,500 for businesses.
financial 93,500 individuals
The average self-reported cost was A$33,000 for individuals and A$93,500 for businesses.
financial 141,300 average cost
Small businesses reported an average cost of A$55,400, medium businesses A$141,300 and large businesses A$148,100.
financial 148,100 large businesses
Small businesses reported an average cost of A$55,400, medium businesses A$141,300 and large businesses A$148,100.
Tactical Metrics
Metrics
data_breach
2,025
Threat Data
Australia’s 2025-26 threat data shows an environment moving faster without abandoning familiar weaknesses.
Metrics
financial
139
Ransomware Incidents
…or context Cyber security incidents 1,524 Up 20% year over year Potential malicious activity notifications More than 4,400 Up almost 80% Cybercrime reports More than 82,000 About one every 6 minutes Ransomware incidents 139 Broadly consistent with last year Data breach incidents 98 Up 66% Average business cost per report A$93,500 Up 16% overall These figures come from different reporting and r…
Why Did Flat Ransomware Volume Still Matter? ASD’s ACSC responded to 139 ransomware incidents , broadly consistent with the previous year.
Metrics
infrastructure
1,000
Vulnerable Devices
ASD’s ACSC then identified almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable Australian organisations, many in critical infrastructure, and issued targeted warnings.
Metrics
financial
33,000
Financial Impact / Stolen Funds
The average self-reported cost for individuals remained A$33,000.
The average self-reported cost was A$33,000 for individuals and A$93,500 for businesses.
Metrics
financial
141,300
Average Cost
Small businesses reported an average cost of A$55,400, medium businesses A$141,300 and large businesses A$148,100.
Metrics
financial
148,100
Large Businesses
Small businesses reported an average cost of A$55,400, medium businesses A$141,300 and large businesses A$148,100.
Metrics
financial
93,500
Individuals
The average self-reported cost was A$33,000 for individuals and A$93,500 for businesses.
Intelligence Sources
SOCRadar CTI Blog 2026-10-27