NAB Business Cyber Security Awareness

Rising Cyber Stakes in Australia

Australian organisations endured a punishing 2025 as cyber threats intensified, with the Australian Cyber Security Centre (ACSC) documenting sharp rises in both attack volume and financial impact. Average cyber crime costs climbed across all business sizes: small businesses faced $56,600 per incident (up 14%), medium ones $97,000 (up 55%), and large organisations $202,700 (a staggering 219% jump). These figures reflect the growing sophistication of attacks, often powered by artificial intelligence, which enable more targeted phishing, ransomware, and exploitation of vulnerabilities.

The surge prompted regulatory tightening. The Cyber Security Act 2024 introduced mandatory reporting of ransomware payments for businesses with annual turnover above $3 million starting 30 May 2025, with enforcement ramping up from January 2026. Amendments to the Security of Critical Infrastructure Act 2018 (SOCI Act) clarified and expanded obligations for protecting critical data storage systems and telecommunications assets, with key rules taking effect in April 2025 and further IoT security standards for smart devices scheduled for 4 March 2026.

High-profile breaches continued into 2026, affecting sectors from hospitality and mining to healthcare and finance, often involving ransomware groups claiming data exfiltration. State-linked actors targeted operational technology in manufacturing and energy, underscoring supply-chain risks. Boards now face explicit guidance to prioritise secure-by-design technology, legacy system replacement, third-party risk management, and post-quantum cryptography transitions.

Tensions emerge between compliance costs and operational realities: smaller businesses struggle with resource demands, while critical infrastructure operators balance enhanced reporting against potential exposure of sensitive information. The shift toward assuming compromise rather than preventing all intrusions forces trade-offs in resource allocation, yet failing to adapt risks regulatory penalties, revenue losses—up to 10% of annual figures in some cases—and eroded customer trust in an interconnected economy.