Small business cybercrime in Queensland: the 2025-26 figures

Queensland lodged 26 per cent of the cybercrime reports ASD received in 2025-26, against about 21 per cent of the population: 5,739,500 of 27,921,150 people at 31 March 2026 on ABS estimates (our calculation). Victoria lodged 27 per cent and New South Wales 22 per cent.

ASD notes that Victoria, Queensland and New South Wales report more cybercrime than any other state or territory. Queensland's share was 28 per cent in 2024-25, the highest of any state that year.

ASD has published the average self-reported cost of cybercrime per small business report in each of its last four annual reports. The 2025-26 figure is printed rounded; the earlier ones are the exact averages ASD charts by business size.

ASD responded to 1,524 incidents in 2025-26. The small organisations and sole traders column of its severity matrix holds 336 of them, 22 per cent (our count), and 24 of those were localised or extensive in effect.

Small businesses lodged 2,228 reports to Scamwatch in 2025, and 287 reported a loss totalling $9.5 million, 27.9 per cent lower than 2024. False billing was the type they reported most. The National Anti-Scam Centre says business false billing reports generally relate to payment redirection, also known as business email compromise.

Investment scams carried the largest small business loss, $6.2 million, followed by false billing at $2.0 million. Across all reporters, payment redirection cost Australians $166.8 million in 2025, second only to investment scams.

The OAIC received 667 notifiable data breach notifications in the first half of 2026, against 662 in the six months before, and a record 1,205 in calendar 2025. Malicious or criminal attacks remain the leading cause.

The OAIC says most small businesses are not covered by the Privacy Act, which draws the small business line at $3 million in annual turnover. A breach at a business outside the Act is not notifiable to the OAIC, so it does not appear in these counts.

In ASD's 2024-25 report, email compromise and business email compromise fraud were the two most reported business cybercrimes, at 19 and 15 per cent of business reports. False billing leads the Scamwatch small business data. Both start with an email, an invoice or a changed bank detail.

ASD advises small businesses to choose products that are secure by design, turn on automatic updates and give someone clear responsibility for security monitoring and incident response.

Every figure comes from a public source published by ASD, the National Anti-Scam Centre, the OAIC or the ABS, read against that source on 6 November 2026. No Black Shard client or engagement data is used. The ReportCyber figures are self-reported, and ASD treats changes under 5 per cent as consistent.

ASD figures cover financial years to 30 June; the Scamwatch, National Anti-Scam Centre and OAIC figures cover calendar years or half years. The Targeting Scams report publishes national figures only, so the Queensland figures come from ASD.