Cybercrime is reported once every six minutes in Australia
ASD’s new threat report counts 82,000 cybercrime reports and says AI is helping attackers move faster. Small businesses report an average cost of $55,400.
Somewhere in Australia, someone reports a cybercrime about every six minutes. For a small business, the average self-reported cost is $55,400.
Those figures come from the Australian Signals Directorate’s Annual Cyber Threat Report 2025-26, published on 28 October. It covers the year to 30 June 2026. The headline theme is AI, which ASD says is helping attackers work faster and at a bigger scale.
The year in numbers
ASD’s Australian Cyber Security Centre (ACSC) received over 82,000 cybercrime reports through ReportCyber. That’s the same pace as last year, and ASD says most cybercrime probably goes unreported.
ASD’s own workload grew faster:
- It responded to more than 1,500 cyber security incidents, up 20% on last year.
- It alerted organisations to possible malicious activity more than 4,400 times, up almost 80%.
- It handled 139 ransomware incidents, about the same as last year.
- Its hotline, 1300 CYBER1, answered over 37,500 calls, about 102 a day. That’s down 12%.
Identity fraud was again the most reported cybercrime, although reports fell 18%. Online shopping fraud and online banking fraud were the other most common types.
What it costs when it happens
Victims report what an attack cost them. The averages:
| Who reported | Average cost per report | Change on last year |
|---|---|---|
| Individuals | $33,000 | About the same |
| Small businesses | $55,400 | About the same |
| Medium businesses | $141,300 | Up 45% |
| Large businesses | $148,100 | Down 27% |
| All businesses | $93,500 | Up 16% |
These are self-reported figures. Still, $55,400 is a serious hit for a small business, and it hasn’t come down.
AI is speeding everything up
The report’s foreword, from Defence Minister Richard Marles, calls AI “the defining force” in the threat landscape over the past year. The report says AI tools let criminals and state-sponsored hackers find weaknesses, build attacks and launch them with less effort.
The clearest example is patching. ASD has previously found that most exploitation happens within two weeks of a weakness being disclosed. Some weaknesses were exploited within 48 hours of a fix or advice being released. ASD expects AI tools to shrink that window further over the next 12 months.
The report puts it bluntly: “In the past, defenders had months to patch, now they have days, sometimes only hours.”
AI is also making scams more convincing. ASD’s factsheet for individuals says phishing emails, scam messages and impersonation attempts are getting harder to spot.
Stolen logins are the way in
Compromised accounts and passwords were among the most common incident types across government, business and critical infrastructure. A real login is valuable to attackers because it gives them legitimate access.
Data breaches also rose. ASD recorded 98 breach incidents, up 66% on the year before.
Some habits make the job easier for criminals. Research for the government’s Act Now. Stay Secure. campaign, quoted in the report, found 55% of people reuse passwords across accounts. It also found 57% don’t review their privacy or location settings.
ASD’s answer is the basics: turn on multi-factor authentication (MFA) or passkeys, use a unique password for every account, and check privacy settings.
What ASD wants businesses to do
For small businesses, the report’s advice is short. Choose products that are secure out of the box and turn on automatic updates. Make sure someone is clearly responsible for watching for problems and responding to them.
For organisations, ASD repeats last year’s four priorities. Replace or protect old technology, keep good event logs, manage the security of suppliers and prepare for post-quantum cryptography. This year it adds a fifth: prepare for AI-enabled attacks. Critical infrastructure operators are told to be ready to isolate systems and networks for up to three months.
ASD also points to its new Essentials series, released this month as the evolution of the Essential Eight. We covered what changed in ASD’s Essentials launch, and the original controls are explained in the Essential Eight in plain English.
Report it, even if it seems small
ASD says reporting helps it spot threats and protect other Australians. Report online at cyber.gov.au/report or call 1300 CYBER1 (1300 292 371). The ACSC gives free incident response advice 24 hours a day.
Checklist
- Turn on multi-factor authentication or passkeys. Use them on every account that offers them, including email and banking.
- Stop reusing passwords. Give every account its own long, unique password.
- Switch on automatic updates. Do it for computers, phones and business software, because attackers now move within days of a fix being released.
- Name who is responsible for security. Decide who watches for problems and who acts if an attack happens, whether that’s you, a staff member or your IT provider.
- Ask your IT provider about old equipment. List any computers, software or devices that no longer get security updates and plan to replace them.
- Check your privacy settings. Review privacy and location settings on your social media and phone accounts.
- Save the reporting details. Report cybercrime at cyber.gov.au/report or call 1300 CYBER1 (1300 292 371), any time of day.
Tick items as you go. Your ticks stay in this browser.
