Business cyber security awareness webinar

Escalating Cyber Risks in Australia

Australian organisations endured a punishing year in 2025 as cyber threats intensified, with the Australian Cyber Security Centre (ACSC) documenting sharp rises in both incident notifications and financial damage. State-sponsored actors continued targeting sensitive networks for espionage, while cybercriminals deployed ransomware at scale, often leveraging AI to automate phishing and exploit weaknesses more efficiently.

The financial toll has become stark. Small businesses now face average cyber crime costs of $56,600, up 14% from prior levels, while medium-sized firms saw a 55% jump to $97,000. Large organisations bore the heaviest burden, with costs ballooning 219% to $202,700 per incident. These figures reflect not just direct extortion but downstream effects: operational downtime, legal fees, regulatory penalties, and lost customer trust.

Regulatory pressure has mounted in tandem. The Cyber Security Act 2024 introduced mandatory ransomware payment reporting, effective from 30 May 2025, requiring entities to notify authorities of any payments made to extortionists. Further rules loom, including mandatory security standards for smart devices supplied to critical infrastructure operators, commencing 4 March 2026. Boards face growing scrutiny to ensure 'secure by design' practices, especially as insurers and supply-chain partners demand higher maturity levels.

High-profile incidents in 2025 amplified the urgency. Qantas suffered a call-centre breach exposing up to six million customer records, attributed to techniques like social engineering and multi-factor authentication bypass. Other attacks hit healthcare providers, law firms, and accounting practices, often via ransomware groups that leaked stolen data when ransoms went unpaid.

A persistent tension lies in human factors. Despite advanced tools, many breaches trace back to phishing, poor password hygiene, or unapproved use of generative AI for work tasks, which risks leaking sensitive data. Awareness efforts struggle against evolving tactics, creating a gap between technical defences and behavioural reality. Businesses must balance compliance checkboxes against genuine resilience, where over-reliance on regulation risks missing adaptive threats from increasingly professionalised criminals.