Australia’s Annual Cyber Threat Report 2025-26 Shows Cyber Incidents Up 20%

Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years. The latest Annual Cyber Threat Report shows that phishing, compromised accounts, unpatched systems, ransomware and data theft remain the main operational pressures.

Artificial intelligence is increasing the speed and scale of many established techniques, but the report’s central message is practical: organisations need to patch faster, protect identities, improve logging, manage supplier access and prepare to continue operating during an incident. The Australian Signals Directorate’s Australian Cyber Security Centre also expanded proactive warning activity, issuing more than 4,400 notifications about potential malicious activity during the year.

What Did Australia Record in 2025-26?

Measure	2025-26 result	Change or context
Cyber security incidents	1,524	Up 20% year over year
Potential malicious activity notifications	More than 4,400	Up almost 80%
Cybercrime reports	More than 82,000	About one every 6 minutes
Ransomware incidents	139	Broadly consistent with last year
Data breach incidents	98	Up 66%
Average business cost per report	A$93,500	Up 16% overall

These figures come from different reporting and response channels. Cybercrime reports, incidents handled and proactive notifications should not be added together as if they represent unique victims. Read together, however, they show both high public reporting volume and a larger operational workload for government responders.

What Changed in Australia’s Threat Picture?

The incident count increased, but the more important shift was in impact. Extensive compromises rose from 26 to 40, even though only one Category 2 (C2) incident, the second-highest severity level, was recorded. Ransomware and distributed denial-of-service activity also produced more extensive compromises despite stable or falling overall volumes.

Improved visibility also contributed to the rise. ASD’s ACSC identified 362 incidents after proactively warning organisations about suspicious activity, while more than half of its individual notifications originated from declassified intelligence. The increase therefore reflects a combination of worsening risk, stronger detection and greater reporting awareness.

How Much Did Cybercrime Cost Australians?

More than 82,000 cybercrime reports were submitted through ReportCyber, or about one every six minutes. Identity fraud remained the most frequently reported cybercrime, although reports in that category fell 18%. The Australian Cyber Security Hotline received more than 37,500 calls, down 12% from the previous year.

The average self-reported cost for individuals remained A$33,000. The business average rose 16% to A$93,500 per report. Small businesses reported an average cost of A$55,400, medium businesses A$141,300 and large businesses A$148,100. The 45% rise for medium businesses stands out because these organisations may combine valuable data and connected systems with fewer specialist security resources than large enterprises.

Which States Reported the Most Cybercrime?

Victoria accounted for 27% of cybercrime reports, followed by Queensland at 26% and New South Wales at 22%. Western Australia represented 12%, South Australia 7%, while the Northern Territory, Australian Capital Territory and Tasmania each accounted for 2%. The report notes that Australia’s three most populous states continued to generate the highest reporting volumes, with disproportionately high reporting rates relative to their populations.

Which Attack Paths Appeared Most Often?

Phishing appeared in 39% of analysed incidents, followed by compromised accounts at 21%, user execution at 17%, valid accounts at 15%, and social engineering at 13%. These percentages overlap because one incident can involve several techniques. The pattern shows why email filtering alone is not enough: identity monitoring, secure recovery processes and post-login detection are also necessary.

Data exposure also became more prominent. ASD’s ACSC responded to 98 data breach incidents, up 66%, while the Office of the Australian Information Commissioner received 1,205 breach notifications during 2025, its highest annual total since the Notifiable Data Breaches scheme began. Stolen personal information can support identity fraud, targeted phishing and account recovery abuse long after the original breach.

Why Did Flat Ransomware Volume Still Matter?

ASD’s ACSC responded to 139 ransomware incidents, broadly consistent with the previous year. However, extensive ransomware incidents increased from 16 to 24. Health Care and Social Assistance, Professional, Scientific and Technical Services, and Manufacturing remained the three most affected industry divisions.

This distinction matters because a stable incident count can hide rising operational harm. Modern ransomware campaigns may combine service disruption, data theft and public extortion, while Ransomware-as-a-Service lowers the barrier for affiliates. Defenders should measure recovery time, systems affected and data exposure, not only the number of attacks.

How Quickly Are Vulnerabilities Being Exploited?

Publicly reported common vulnerabilities and exposures (CVEs) increased 30%. ASD’s ACSC says most vulnerability exploitation occurs within two weeks, while some flaws are exploited within 48 hours of patch or mitigation guidance. It also recorded successful exploitation of a vulnerability first identified in 2008, showing that organisations must address both newly disclosed flaws and unsupported legacy systems.

A useful lesson is that patch speed depends on preparation before a vulnerability is disclosed. Organisations need a current inventory of internet-facing systems, clear ownership, tested emergency change procedures and a way to verify that a fix reached the running service. A policy target has limited value if teams cannot identify the affected asset or confirm deployment.

How Did Proactive Warnings Reduce Risk?

The report provides two examples of threat intelligence changing outcomes. A collective notification about cPanel vulnerabilities was sent to 340 entities and resulted in more than 60 incidents being confirmed. In a separate Akira ransomware investigation, reports from multiple organisations helped ASD’s ACSC connect activity to exploitation of a known SonicWall vulnerability.

ASD’s ACSC then identified almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable Australian organisations, many in critical infrastructure, and issued targeted warnings. Similar reported incidents declined after the public alert. The practical insight is that reporting is not only a compliance task: shared evidence can reveal a campaign early enough to protect organisations that have not yet detected it.

Where Did Cyber Risk Concentrate?

Federal government accounted for 32% of incidents reported to ASD’s ACSC, followed by state and local government at 16%. The report cautions that government reporting obligations influence these totals. Health Care and Social Assistance was the leading non-government sector at 7%, while Manufacturing entered the top ten and recorded the largest increase in reports.

Critical infrastructure accounted for 154 incidents, or 10% of the total, down almost 7%. Phishing was the leading initial-access method in these incidents at 36%, followed by valid accounts at 16% and drive-by compromise at 10%. Financial and insurance services represented 30% of critical infrastructure incidents, ahead of public administration and safety at 21%, and electricity, gas, water and waste services at 17%.

State-sponsored actors continued to seek sensitive information and access that could support later espionage or disruption. The report specifically notes that China-nexus actors increasingly use covert networks built from compromised small-office/home-office routers, Internet of Things devices and smart devices to conceal the origin of malicious activity. This makes asset ownership and secure configuration important beyond conventional servers and employee endpoints.

How Is AI Changing the Operating Tempo?

The report does not present AI as a separate attack type. Instead, it describes AI as an accelerator for reconnaissance, vulnerability research, exploit development, phishing, impersonation, stolen-data analysis and malicious code adaptation. The immediate risk is less about an unfamiliar technique and more about familiar techniques becoming faster, cheaper and easier to personalise.

AI can also improve defence by analysing security data, identifying vulnerabilities, monitoring unusual behaviour and supporting incident response. Those benefits depend on governance. Organisations should limit the sensitive data available to AI systems, apply least privilege, retain audit records and require human review for consequential actions. Security teams should evaluate AI as both a new dependency and a defensive tool.

Why Are Supply Chains and Code Repositories a Priority?

Third-party access and software dependencies can spread one compromise across many organisations. ASD’s ACSC observed attackers using social engineering, stolen credentials and authentication tokens to enter code repositories, expose private source code, steal secrets and modify trusted software packages.

The report uses the self-replicating Shai-Hulud campaign as an example. After a maintainer account was compromised, malicious package versions harvested credentials and cloud metadata, exposed stolen secrets in public repositories and used captured access to compromise other packages. Organisations therefore need an accurate inventory of dependencies and deployed versions, tightly controlled maintainer privileges, secret scanning and rapid token revocation.

What Should Organisations Do Now?

• Accelerate patching. Prioritise internet-facing and actively exploited vulnerabilities, replace unsupported technology and verify remediation in production.
• Protect identities and sessions. Use phishing-resistant authentication, restrict privileges, secure recovery processes and monitor unusual token or session use.
• Improve event logging. Retain the identity, endpoint, cloud, application and network evidence needed to understand access, impact and data exposure.
• Reduce supplier and software risk. Map third-party access, dependencies, privileged integrations, code repositories and secrets, then test revocation and containment.
• Plan for disruption. Adopt an assumed-breach mindset, test incident response and recovery, and define how critical services will continue when systems are unavailable.
• Govern AI use. Limit data exposure, enforce least privilege, validate outputs and retain human oversight for actions that affect systems or customers.
• Report suspicious activity early. Technical details and indicators can help authorities identify a wider campaign and warn other potential targets.

What Is the Main Takeaway?

Australia’s 2025-26 threat data shows an environment moving faster without abandoning familiar weaknesses. AI is compressing response time, but credentials, phishing, unpatched systems, supplier access and recovery readiness continue to shape real-world outcomes.

The report’s most useful message is operational: proven controls need to work at greater speed and across the full environment. Organisations that know their assets, protect legitimate access, preserve evidence and practise recovery are better placed to contain both established attacks and AI-assisted variants.

Frequently Asked Questions

What Is the Annual Cyber Threat Report 2025-26?

It is the Australian Signals Directorate’s annual assessment of cyber threats affecting Australian individuals, businesses, government and critical infrastructure. It combines incidents handled by ASD’s ACSC, public cybercrime reports, threat intelligence, notifications and case studies from the 2025-26 financial year.

How Many Cyber Security Incidents Did Australia Record?

ASD’s ACSC responded to 1,524 incidents, up 20% from the previous year and 36% over five years. This is the number of incidents handled by the national cyber security authority, not a complete count of every incident that occurred in Australia.

What Is the Difference Between a Cybercrime Report, an Incident and a Notification?

A cybercrime report is submitted through ReportCyber by a member of the public or an organisation. A cyber security incident is activity that ASD’s ACSC assessed or assisted with, while a notification is a warning sent to an entity about potential malicious activity or exposure. The categories can overlap, so their totals should not be combined.

What Was the Most Common Attack Technique?

Phishing was the most prevalent MITRE ATT&CK technique, appearing in 39% of analysed incidents. Compromised accounts, user execution and valid accounts were also common, showing that attackers frequently combine social engineering with legitimate credentials or sessions.

How Much Did Cybercrime Cost Australian Victims?

The average self-reported cost was A$33,000 for individuals and A$93,500 for businesses. These are averages for reports that included a cost, not an estimate of Australia’s total economic cost, and the business figure varied substantially by organisation size.

Did Ransomware Increase in 2025-26?

The total remained broadly stable at 139 incidents, but extensive ransomware compromises increased from 16 to 24. This means the volume was flat while the number of more consequential incidents rose.

How Serious Was the Data Breach Trend?

ASD’s ACSC responded to 98 data breach incidents, a 66% increase. Stolen personal information can be reused for identity fraud, targeted social engineering and account recovery attacks, so the effects may continue well beyond the initial intrusion.

How Is AI Affecting Cyber Security?

AI is reducing the time and skill needed for reconnaissance, exploit development, phishing and data analysis. It can also help defenders find vulnerabilities, analyse events and respond faster. The report recommends using AI with controlled data access, auditability and human oversight.

How Fast Do Organisations Need to Patch?

There is no single safe deadline for every vulnerability. ASD’s ACSC has observed most exploitation within two weeks and some within 48 hours of patch or mitigation guidance, so internet-facing and actively exploited flaws require urgent action. Organisations should also identify and replace unsupported systems that cannot receive fixes.

Which Sectors Reported the Most Incidents?

Federal government reported the largest share at 32%, followed by state and local government at 16%. Health Care and Social Assistance led non-government sectors at 7%. These percentages reflect reporting to ASD’s ACSC and are influenced by sector-specific obligations and reporting maturity.

What Should Smaller Organisations Prioritise First?

Start with a small set of controls that reduce common attack paths: automatic updates, phishing-resistant authentication, protected backups, secure account recovery, basic event logging and a tested incident contact process. Choosing products that are secure by default can reduce the operational burden where specialist resources are limited.

Why Does Reporting an Incident Matter?

A single report may reveal infrastructure, indicators or techniques affecting other organisations. The Akira and cPanel examples show how combined evidence and proactive notifications can identify vulnerable entities and reduce further incidents. Australian organisations can report even when compromise has not yet been confirmed.