Cost of cyber crime rises for small business

The ASD has released its fifth ASD Cyber Threat Report (ACTR), outlining the ongoing cyber threat to Australia’s businesses and organisations, critical infrastructure and individuals.

The latest edition for 2023-24 notes state-sponsored cyber actors and cyber criminals continually target Australian organisations and individuals using evolving tactics.

Of note, while large and medium companies were able to reduce the impact of cyber crime, the cost rose again for small business, highlighting the vulnerability and lack of resourcing or education faced by smaller entities.

However, the speed with which cyber threats spread and evolve means that no single person or organisation can effectively defend against all threats in isolation. Cooperation on a national scale is one of Australia’s greatest advantages against malicious cyber activity, ASD says.

Key findings from the report include:

• The ASD answered more than 36,700 calls to the Australian Cyber Security Hotline, up 12 per cent on the previous year. That equates to about 100 calls per day, up from 90.
• It received over 87,400 cyber crime reports, down seven per cent, though this still equates to one report every six minutes, which is consistent with last year.
• 11 per cent of all incidents responded to included ransomware, a three per cent increase from last year.
• The average self-reported cost of cyber crime per report for individuals was up 17 per cent ($30,700).
• The average self-reported cost of cyber crime per report for businesses was down eight per cent overall, driven by an average cost decrease of 35 per cent for medium business (average of $62,800 and 11 per cent for large business (to $63,600). However, the host for small business increased eight per cent for small business, up to $49,600
• The top three self-reported cyber crime types for individuals were identity fraud (26 per cent), online shopping fraud (15 per cent) and online banking fraud (12 per cent)
• Top three self-reported cyber crime types for business were email compromise (20 per cent), online banking fraud (13 per cent) and business email compromise fraud (13 per cent).

The Australian Government noted the ongoing importance of investment and education to help combat cyber threats.

Deputy Prime Minister and Minister for Defence Richard Marles said: “This year’s report outlines the cyber threat posed to Australian governments, critical infrastructure, businesses and households. It shows how malicious state actors and cybercriminals are continuing to adapt their tradecraft in an attempt to compromise Australian networks.

“This report highlights the importance of strong partnerships between the public and private sectors in defending Australians from cyber threats and making our country a harder target. It also reflects the concrete steps we are taking to deter cybercriminals and hold them to account.”

What should Australian businesses and organisations do?

According to ASD, good cyber security is not set and forget – businesses should continually:

• treat a cyber incident as a ‘when’ not an ‘if’ – have a cyber security incident response plan and test it regularly with your staff to ensure an effective response and fast recovery
• ensure products and services are secure-by-design and secure-by-default
• follow best practice cyber security – adopt ASD’s Essential Eight, which is evolving to address new threats and mitigations
• enable multi-factor authentication (MFA), when available
• use long and unique passphrases for every account – password managers can assist with such activities
• turn on automatic updates for all software – do not ignore update prompts. · backup important files and device configuration settings regularly
• be alert for phishing messages and scams. Ensure staff are trained to identify phishing messages and scams
• stay engaged with cyber security – whether you’re an individual or an enterprise. ASD’s ACSC Cyber Security Partnership Program offers free easy-to-follow cyber security advice for all Australians.

Online shopping warning

The National Anti-Scam Centre is urging online shoppers to remain vigilant as it aims to disrupt scammers targeting Australians shopping online.

The Centre, which is run by the ACCC and coordinates government, law enforcement and the private sector to combat scams, has already removed or limited access to thousands of investment, phishing, and online shopping scam websites this year.

Online shopping scams account for 50 per cent of the fraudulent or malicious websites taken down in the past three months.

ACCC Deputy Chair Catriona Lowe said anyone who comes across a suspicious website should report it immediately.

“The longer a scam website is active, the more legitimate it may seem and the greater the risk there is for people to lose money.

“If you come across a suspicious website, please report it immediately via the updated short-form reporting tool on the Scamwatch website (www.scamwatch.gov.au) so we can quickly remove or limit access to the fraudulent site and protect other consumers against financial harm.”

How the Victorian Chamber can help

The Victorian Chamber is a vocal advocate of improved cyber security outcomes for Australia and has advised the Australian Government and business on best-practice approaches.

We also know cyber education and training is vital but accessing cyber awareness training has often been out of reach for SMEs.

However, in conjunction with global industry leaders Fortinet and Mimecast, the Victorian Chamber’s CyberSimple suite offers affordable and accessible cyber products. Our online and self-paced learning programs help you ensure your staff are prioritising cyber safety.

The Victorian Chamber is proud to announce CyberSimple has been recognised as a 2025 iTnews Benchmark Awards project finalist for the not-for-profit category.

Since 2012, the iTnews Benchmark Awards have celebrated technology excellence, recognising both IT projects and leaders that have transformed Australian business.

With Christmas approaching, to celebrate we're offering 25 per cent off all CyberSimple courses! Visit the CyberSimple suite to protect your business from attacks, threats and scams.