Breach cost estimator (Australia)

Estimated cost of the incident

$7,800 for this scenario.

• $7,800 in paid time lost

  10 people, 3 days at 50% reduced output, at your $520 loaded day rate.

• What the estimate leaves out

  Attention pulled off every other priority for weeks, deals that quietly stall, insurance excess and premium movement, and the second incident if root cause never gets fixed.

Every number above comes from your inputs. The defensible version of this exercise is a risk assessment against your actual systems and obligations.

The Australian figures

What was reported, as its publisher printed it. An average is an average of what was reported; a maximum is a maximum.

• A$55,400

  Average self-reported cost of cybercrime per report, small business

  ASD reports it consistent with the year before.

  Australian Signals Directorate, Annual Cyber Threat Report 2025-26, Year in review, at a glance, business. Retrieved 31 Oct 2026.

• 59 percent

  of 1,205 breach notifications in January to December 2025 came from malicious or criminal activity

  716 of 1205, the scheme’s highest annual count since it began. Health service providers were the top sector at 19 percent. The January to June 2026 half brought 667 notifications, up from 662 in the half before; 11 breaches affected more than a million people.

  Office of the Australian Information Commissioner, Notifiable Data Breaches statistics for 2025, media release of 6 July 2026, Opening paragraph; source of breaches; sectors. Retrieved 31 Oct 2026.

  Office of the Australian Information Commissioner, Notifiable Data Breaches statistics for January to June 2026, media release of 26 October 2026, Media release, opening paragraph. Retrieved 31 Oct 2026.

• A$50,000,000

  Maximum civil penalty for a serious interference with privacy, body corporate

  The greatest of this amount, three times the benefit obtained, or 30 percent of adjusted turnover.

  Federal Register of Legislation, Privacy Act 1988, Compilation No. 104 (C2026C00227), 4 June 2026, Section 13G(3)(a). Retrieved 30 Oct 2026.

• 2,000 penalty units

  Maximum civil penalty for an interference with privacy that is not serious

  A body corporate pays up to 5 times that. The value of a penalty unit is set by the Crimes Act 1914, section 4AA.

  Federal Register of Legislation, Privacy Act 1988, Compilation No. 104 (C2026C00227), 4 June 2026, Section 13H(3). Retrieved 30 Oct 2026.

  Federal Register of Legislation, Regulatory Powers (Standard Provisions) Act 2014, Compilation No. 4 (C2024C00118), 20 March 2024, Section 82(5)(a). Retrieved 30 Oct 2026.