Annual Cyber Threat Report 2025-26

What ASD’s ACSC saw

	Answered over 37,500 calls to the Australian Cyber Security Hotline, down 12%. On average, 102 calls per day, a decrease from 116 calls per day.
	Received over 82,000 cybercrime reports to ReportCyber. On average a report every 6 minutes, consistent with last year.
	Individuals Average self-reported cost of cybercrime per report for individuals remained consistent with last year ($33,000).
	Business Average self-reported cost of cybercrime per report for businesses, up 16% overall ($93,500). small business: $55,400 (consistent with last year) medium business: $141,300 (up 45%) large business: $148,100 (down 27%).
	Identity fraud remained the top reported cybercrime, down 18% from last year.
	Publicly reported common vulnerabilities and exposures (CVEs) increased 30%.
	Over 2,959,800 total users visited cyber.gov.au, generating nearly 6,281,700 views.
	Over 262,800 downloads of our advice or guidance on cyber.gov.au.

What ASD's ACSC did

	Responded to over 1,500 cyber security incidents, up 20% from last year.
	Notified entities of potential malicious cyber activity more than 4,400 times, up almost 80%, to help prevent incidents before they occurred, including: Over 2,200 individual notifications, up 33%. Collective notifications to over 2,100 entities.
	Identified 362 incidents following proactive notifications.
	Responded to 139 ransomware incidents, consistent with last year.
	Australian Protective Domain Name System processed more than 220 billion queries and blocked customer access to over 564 million malicious domains.
	Cyber Threat Intelligence Sharing (CTIS) grew by 22% to over 550 partners, and shared over 1 million indicators of compromise via the platform.
	ASD’s Cyber Security Partnership Program grew by 12% to over 149,500 partners.
	Led 15 cyber security exercises, involving over 335 organisations.
	Briefed board and executive leadership team representatives from 29% of the ASX100.
	Published 52 publications to the Partner Portal.
	Published a total of 76 alerts, advisories and publications on cyber.gov.au, including a range of joint products with international partners.
	Cyber Hygiene Improvement Programs  Distributed over 8,300 notifications identifying active cyber risks. Distributed over 14,000 reports to approximately 3,500 customer organisations. Distributed over 12,300 notifications of possible compromise to approximately 1,885 organisations.
	Government Uplift Program  There were 37 Cyber Uplift Remediation Program engagements. Completed 3 Government Cyber Assessment Team (GovCAT) assessments – identifying vulnerabilities and supporting critical functionality. Trained 9,955 participants in Privileged User Training. Uplifted 20 instances of commonly used cyber security software through their configuration.  Assisted 8 entities with visibility and detection uplift.
	Critical Infrastructure (CI) Uplift Program Completed 6 CI uplifts. Completed 12 CI uplift sprints. Held 10 technical cyber security workshops with CI operators. Reached 258 representatives from 157 CI organisations through Operational Technology Information Exchanges.

Timeline of key events and publications

ASD’s ACSC categorises each cyber security incident it responds to on a scale of Category 1 (C1), the most severe, to Category 6 (C6), the least severe. Cyber security incidents are categorised on severity of impact and significance of the organisation’s impact to Australia.

FY2025–26 demonstrated that the cyber threat environment continues to be shaped by compromises from well known weaknesses such as unpatched systems and social engineering, while the operating environment continues to evolve. More interconnected systems, third party suppliers and supply chains mean one compromise makes incidents far more complex in this current environment. FY2025–26 also saw cyber security awareness growing and improved reporting practices across the economy. 

In FY2025–26, ASD’s ACSC responded to over 1,500 incidents, an increase of more than 20% from last year. Of the incidents ASD’s ACSC responded to this year, 362 were identified following proactive ASD’s ACSC notifications to entities of potential malicious activity on their network. In FY2025–26, ASD’s ACSC issued over 4,400 notifications (including mass notifications) of suspicious cyber activity, almost 80% more than FY2024–25. More than 51% of individual notifications originated from declassified intelligence, providing reliable and actionable information directly to Australian organisations.

• A collective notification to 340 entities in May 2026 regarding the cPanel CVEs resulted in more than 60 confirmed incidents.
• ASD’s ACSC received fewer phone calls reporting cyber security incidents this financial year; however, the number of incidents reported (including unsuccessful incidents) increased, which likely indicates improved cyber security awareness and reporting culture.

Incidents categorised as C3 or above often involve organisations such as federal and state governments, large organisations, academia and supply chains. While the number of higher categorised incidents decreased in FY2025–26 with only one C2 incident recorded, the number of extensive compromises increased from 26 in FY2024–25 to 40 in FY2025–26. Furthermore, analysis of MITRE ATT&CK tactics, techniques and procedures (TTPs) indicates an increasing complexity in depth and breadth of cyber tactics. Of note:

• The frequency of ‘User Execution’ and ‘Social Engineering’ techniques demonstrates that humans remain an enduring target for all incident categorisations.
• The high rate of ‘Data Encryption for Impact’ suggests that ransomware is a strong contributor to C3 and higher incidents in FY2025–26.

In previous years, major Denial of Service (DoS)/Distributed Denial of Service (DDoS) campaigns accounted for higher incident numbers; however, due to the absence of any coordinated DDoS campaigns by malicious cyber actors in FY2025–26, ASD’s ACSC recorded lower numbers of DoS/DDoS incidents. ASD’s ACSC responded to more than 80 incidents involving DoS/DDoS,down more than 60% from last year.

DoS/DDoS attacks remain a common tactic used to disrupt services and affect organisational operations. Although fewer incidents were reported, those that did occur resulted in more significant impacts. Extensive compromises from DDoS activity increased from one in FY2024–25 to seven in FY2025–26.

ASD’s ACSC is consistently seeing cyber security incidents resulting from unpatched vulnerabilities. This year, ASD’s ACSC recorded successful exploitation of a vulnerability identified in 2008, demonstrating the need to patch legacy vulnerabilities, as well as keeping on top of patching new ones. AI is reducing the expertise and effort required to identify and exploit vulnerabilities, likely accelerating Time to Exploit (TTE) and increasing the number and diversity of actors able to undertake cyber attacks.

Image

• Federal Government: 32%
• State and Local Government: 16%
• Health Care and Social Assitance: 7%
• Professional, Scientific and Technical Services: 6%
• Financial and Insurance Services: 6%
• Information Media and Telecommunications: 5%
• Education and Training: 4%
• Manufacturing: 4%
• Construction: 3%
• Retail Trade: 3%

Note: ASD’s ACSC categorises sectors following the Australian and New Zealand Standard Industrial Classification (ANZSIC) Divisions from the Australian Bureau of Statistics.

In FY2025–26, Government again reported the highest number of incidents, led by the Federal Government, likely due to Government’s additional reporting obligations. Of note, Health Care and Social Assistance rose to be the most frequently reporting non-government sector, followed by Professional, Scientific and Technical Services. This year saw the emergence of the Manufacturing sector into the top 10, having the largest increase in incident reports across all sectors, while Transport dropped out of the top 10.