Report
What a cyber incident costs an Australian business
The Australian Signals Directorate puts a figure on what a cybercrime cost the business that reported it, by size of business, for the year to 30 June 2025. Three years of the figure show where each size band sits, and two of the three crimes businesses reported most are an attacker inside a mailbox.
- ASD figures of 14 Oct 2025, read 17 Feb 2026
- First published 17 Feb 2026, this edition 29 Oct 2026
- PDF, 6 pages, 292 KB
- BS-RPT-06, version 1.1
Executive summary
Businesses that reported a cybercrime to ReportCyber in the year to 30 June 2025 put its cost at $80,850 on average, up 50 per cent on the year before. A small business put the cost at $56,600 on average, up 14 per cent; the exact average was $45,965 in the year to June 2023, $49,615 in the year to June 2024 and $56,571 in the year to June 2025. A medium business put it at $97,200 on average, up 55 per cent; the exact average was $97,203 in the year to June 2023, $62,870 in the year to June 2024 and $97,166 in the year to June 2025.
ReportCyber received over 84,700 cybercrime reports in the year to 30 June 2025, down 3 per cent on the year before, one every 6 minutes. The three cybercrimes businesses reported most were email compromise with no financial loss, 19 per cent of business reports; business email compromise fraud with a financial loss, 15 per cent; and identity fraud, 11 per cent.
The averages are what the reporting business estimated at the time it lodged the report, so each is a floor. For a small firm the small-business figure is the cost of one bad week: a mailbox taken over, an invoice paid into the wrong account, or a laptop encrypted. The professional fees, the lost days and the customers who leave arrive after the report is lodged and are mostly outside it.
Two of the three crimes businesses reported most begin with an attacker inside a mailbox, and the third, identity fraud, is often fed from what was read there. The controls that stop them sit at the base of every Australian standard: phishing-resistant sign-in, a rule for changes to bank details, authenticated outbound mail, and systems that are patched and backed up.
- Find your firm’s size band in the ASD’s figures and treat the average as the floor of what one incident costs.
- Put phishing-resistant multi-factor authentication on every mailbox, and confirm every change to bank details by phone.
- Decide now who runs the first hour, who calls the bank and who reports to ReportCyber.
Report
The figures
The cost of a cybercrime report, by business size
The three cybercrimes businesses reported most
What to do
Start with the three crimes the ASD’s business reporters named most. For a firm with no security staff this is the order: each step stops a reported crime, and each can be read back from the system that enforces it.
- Enforce phishing-resistant multi-factor authentication on every mailbox, including shared mailboxes and the owner’s, and block the older sign-in methods that bypass it.
- Write the payment rule and make it a habit: every new or changed bank account is confirmed by a phone call to a number already held, before any money moves.
- Turn on alerts for new inbox rules, mail forwarding to outside addresses and sign-ins from places your staff do not work.
- Publish SPF, DKIM and a DMARC policy that rejects, so mail that forges your domain is rejected by your customers’ and your bank’s mail servers.
- Register the obvious near-matches of your domain, and tell your customers which address your invoices come from.
- Patch the systems that face the internet on a short clock, and keep a backup copy that a compromised administrator cannot delete, with a restore that has been timed.
- Hold identity documents only while you need them, in one place, with a deletion date.
- Decide who runs the first hour of an incident, who calls the bank, who reports to ReportCyber and who decides whether a breach is notifiable, and write it on one page.
- Put your own figures through an incident cost estimator and keep the result for the next conversation about what the controls cost.
We run incident response readiness as an engagement that starts with its scope, timeframe and price in writing: the first-hour plan, the payment rule, the alerts above turned on and tested, and a rehearsal with the people who would run it. The same basics are among the controls SMB1001 and the Essential Eight ask for, so a firm that wants a certificate or an assessed maturity level at the end of the work takes the uplift as one engagement. A firm with an incident under way goes to blackshard.com.au/breach.
Method
Every figure comes from the web edition of the Annual Cyber Threat Report the Australian Signals Directorate published on 14 October 2025, which covers the year to 30 June 2025. We read the edition on 17 February 2026 and print each figure as the ASD states it: the rounded averages and the rises from its summary, and the exact averages by business size for each of the three years in the figure in which it charts cost by business size.
The cost is self-reported. The business that lodged the report to ReportCyber estimated its own loss at the time, and nobody audited the estimate. The ASD prints the average for small, medium and large businesses. Take the band your firm would report under and treat its average as a floor: an estimate made in the first days of an incident rarely counts the lost work, the professional fees and the customers who leave.
Large businesses made just over 12 per cent of the business reports, down 22 per cent on the year before. We print the large-business average with the ASD’s caveat and build nothing on it.
To read the figures against your own estate, take three numbers: the average for your band, the number of working days your business could run without its main systems, and the daily value of the work that would stop. The product of the last two is the part of the cost a reported average understates most. Our free incident cost estimator does the arithmetic in the browser from your own inputs and sends nothing to us, and the result is the number a board weighs the cost of controls against.
Each of the three crimes reported most has a control that stops it. Email compromise is stopped at sign-in by phishing-resistant multi-factor authentication, and caught early by an alert on new inbox rules and on sign-ins from places your staff do not work. Business email compromise fraud is stopped by a rule that every change to bank details is confirmed by phone on a number already held. Identity fraud is reduced by holding fewer identity documents for less time, and by authenticated outbound mail, so a message that forges your domain is rejected before it reaches a customer or your bank.
BS-RPT-06, published 17 Feb 2026, revised 29 Oct 2026
The full report, as a PDF
PDF, 6 pages, 292 KB. ASD figures of 14 Oct 2025, read 17 Feb 2026.
More reports
Report
Security events by hour: what our monitoring sees
Measured 26 Oct 2026, 00:45 AEST · PDF, 6 pages, 213 KB
