Annual Cyber Threat Report 2025-26
The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.
- Published
-
- Last reviewed
-
Cybercriminals
Cybercrime continues to be a pervasive threat to Australia’s economic and social prosperity. Cybercrime is persistent and damaging across all facets of Australia’s economy as cybercriminals are willing to exploit opportunities for profit. The online domain has become an integral and ubiquitous part of daily life; with digital infrastructure and the information that companies hold being prime targets for cybercriminals.
Cybercriminals target Australian individuals and organisations for financial gain, attempting to conduct extortion, often using ransomware attacks or data theft. In the 2025–26 financial year, ASD’s ACSC received over 82,000 cybercrime reports through ReportCyber; however, it is likely that most cybercrime goes unreported.
Data theft
Data theft remains an ongoing and serious threat to Australians. PII – such as date of birth, email address and Medicare number – is highly valuable to cybercriminals, who exploit it as a commodity. Cybercriminals also use PII as a target to be acquired for other purposes, including the planning and execution of further criminal activities. For example, stolen PII can be used or sold on the dark web, aiding identity theft schemes and additional cyberattacks.
The average self-reported cost of cybercrime overall was $38,130 – with identity fraud, online shopping fraud, and online banking fraud the most frequently reported cybercrime types. Of the cyber security incidents recorded by ASD’s ACSC during FY2025–26, 98 were data breaches, accounting for over 6% of all incidents. This was an increase of 66% in data breach incidents compared to the previous year.
On 30 July 2025, ASD’s ACSC and international partners released an updated joint advisory in response to recent activity by Scattered Spider threat actors against commercial facilities sectors, subsectors and other sectors.
Scattered Spider threat actors typically engage in data theft for extortion and use several ransomware variants, most recently deploying ransomware alongside their usual TTPs. While some TTPs remain consistent, Scattered Spider threat actors often change TTPs to remain undetected.
Scattered Spider has been observed researching organisations to identify usernames, passwords, PII, and to conduct SIM swaps. The threat actors then use layered social engineering techniques which frequently occur over several calls. The social engineering attempts are designed to first learn what steps are needed to conduct password resets from helpdesks. Once that information is identified, the threat actors continue to conduct phone calls to employees and help desks to gather password reset specific information of a targeted employee.
Finally, the threat actors conduct spearphishing calls to convince IT help desk personnel to reset passwords and/or transfer multi-factor authentication tokens. At which point, the threat actors perform account takeovers against the users in single sign-on environments. These social engineering attempts are enriched by access to personal information derived from social media, open-source information, commercial intelligence tools, and database leaks.
2025 marked the highest number of notifications in a year since the OAIC’s Notifiable Data Breaches scheme commenced in 2018, with 1205 breaches.
Between July and December 2025, malicious or criminal attacks accounted for 405 of the overall number of breaches, remaining the largest source of data breaches for that reporting period.
This was particularly significant within the health sector, which reported 64 notifications of this nature during the 6-month period. Cyber security incidents can have significant impacts on individuals, and organisations need to remain vigilant and alert to the risks.
The OAIC does not take regulatory action in response to every data breach. Instead, they direct efforts to where they can have the greatest impact and to where there is the largest risk of harm to the community. There is more detail in their Statement of regulatory approach at oaic.gov.au.
Ransomware
Ransomware continues to stand out as one of the most disruptive, costly and persistent cyber challenges facing Australia in FY2025–26. Over the past decade, ransomware has evolved from using basic encryption and extortion into an interconnected ecosystem where cybercriminals communicate and conduct payments through borderless online spaces that makes investigating cybercrime difficult. Cybercriminals often use ransomware to encrypt information, including PII, and demand a ransom to prevent the information from being leaked or sold online.
In FY2025–26, ASD’s ACSC responded to 139 ransomware incidents, a figure consistent with the previous year. While the 3 ANZSIC divisions most affected by ransomware, Health Care, Professional, Scientific and Technical Services, and Manufacturing, remained unchanged, the severity of incidents increased, with extensive ransomware incidents rising from 16 to 24.
The growth of the Cybercrime-as-a-service (CaaS) ‘business model’ has made cybercrime more accessible, scalable and efficient. This means that less skilled cybercriminals can access ready-made malware and infrastructure, increasing the number of malicious cyber actors in cybercrime. AI is also streamlining processes across the CaaS ecosystem, making cybercrime faster, less expensive and more effective than ever before.
Ransomware developers are responsible for the creation, upkeep and improvement of ransomware products. Commonly seen in the Ransomware-as-a-Service (RaaS) model, ransomware affiliates can purchase and customise ransomware for their attacks, then share a percentage of the profits with the RaaS developer. Payments to developers can also include rental or subscription-based services.
Paying a ransom does not guarantee recovery of ransomed data, nor prevent it from being sold or leaked online. Paying a ransom also helps promote ransomware as a profitable criminal enterprise. For more information, visit Learn about ransomware.
In March 2026, ASD’s ACSC in collaboration with international partners – Kingdom of Tonga’s National Computer Emergency Response Team (CERT Tonga) and New Zealand’s National Cyber Security Centre (NCSC) – released a joint advisory on the ransomware group, INC Ransom.
INC Ransom is a financially motivated cybercriminal group that provides a RaaS operation to its affiliate network. The group and its affiliate network have previously targeted the US and UK; however, since early 2025, they have been increasingly observed targeting Australia, New Zealand and the Pacific Island states.
In mid-June 2025, the Tongan Ministry of Health (MoH) was impacted by a ransomware attack that rendered core services inaccessible and disrupted the national health care network. INC Ransom later claimed responsibility for the attack.
INC Ransom affiliates use double extortion tactics. Affiliates steal sensitive data, encrypt files, and threaten to publish stolen data, via their data-leak site, to pressure organisations into paying the ransom. The affiliates rely on compromised credentials or public-facing vulnerabilities for initial access into the victim’s networks. For more information, see INC Ransom Affiliate Model Enabling Targeting of Critical Networks.
In November 2025, the Australian Government imposed targeted financial sanctions, under the Autonomous Sanctions Regulations 2011, against 2 Russian cybercrime service providers – Media Land LLC and ML. Cloud LLC – and 2 of their key personnel – Aleksandr Alexandrovich Volosovik and Kirill Andreevich Zatolokin. These sanctions were in response to these organisations’ provision of ransomware infrastructure to malicious cyber actors and cybercriminals, allowing them to conduct cyber attacks in Australia and around the world. In Australia, these attacks were conducted against Australian financial institutions, Australian businesses and their customers, and international CI.
Australia’s cyber sanctions are strengthened by trilateral sanctions imposed by the US and UK against these malicious cyber actors, demonstrating our collective resolve to combat cybercrime.
This is the fifth time we have activated Australia’s autonomous cyber sanctions framework, part of the Australian Government’s coordinated action against cybercrime. These latest sanctions make it a criminal offence to provide assets to either Media Land entity or the 2 sanctioned individuals, or to use or deal with their assets, with penalties of up to 10 years’ imprisonment and/or heavy fines. These sanctions also ban the individuals from entering Australia.
Malicious cyber actors will persistently target Australian governments, CI, businesses and individuals. This threat will continue to be met by the collaborative work of the AFP, ASD’s ACSC, DFAT, and the whole of government through Australia’s autonomous cyber sanctions framework. Cyber sanctions are a key tool to disrupt and deter malicious cyber actors and protect Australians from this threat.