The staggering cost of cyber crime on SMEs

The Cyber Threat Report also highlights the urgency of action by all Australians and businesses to raise the nation’s cyber defences.

Key findings

In the past year, Australia’s lead agency for cybersecurity:

• answered over 42,500 calls to the Australian Cyber Security Hotline, equating to around 116 calls per day, up 16 per cent
• responded to more than 1,200 cyber security incidents, an 11% increase from 2023-24
• received over 84,700 cybercrime reports, an average of one report every 6 minutes, consistent with last year.

The average self-reported cost of cybercrime per report for small business rose by 14 per cent to $56,600, while the cost to individuals rose 8 per cent to $33,000.

According to the report, “small-to-medium enterprise (SME) owners experienced significantly higher rates of all types of cybercrime in both 2023 and 2024.

“When they fell victim, SME owners were more likely to have lost money or spent money on consequences and, when they did, they lost larger amounts of money than other victims.

“In 2024, 22 per cent of respondents who were SME owners said their business was impacted by cybercrime.”

New types of attack

This year’s report illustrated how cyber criminals continue to impact Australians, leveraging new technologies and techniques to expand their attacks and cause harm.

Among the technologies, it notes “generative artificial intelligence (GenAI) has the potential to generate significant benefit for the Australian economy and society. It also creates an avenue for cybercriminals to streamline and scale their activities.”

GenAI models are a type of AI that can create new content, including text, code, images and videos, based on previous learning and user prompts.

“Cybercriminals use GenAI to automate the analysis of extensive datasets, such as identifying valuable credentials or extortion material in stolen data. They also use GenAI to create high-quality videos, fake voices, websites, know-your-customer records and spearphishing emails to more convincingly present themselves to victims as legitimate actors with relatively minimal effort,” the report adds.

Cyber defences

The report reiterates that the most effective cyber defences are also some of the easiest to use and fastest to setup. These include:

• Use phishing-resistant MFA wherever possible, preferably passkeys
• If you use passwords or passphrases, make them strong and unique, and consider using a reputable password manager
• Regularly back up important files and device configuration settings
• Be alert for phishing messages and scams
• Keep software on devices updated, and only use a trusted device when accessing sensitive online accounts. For example, use your bank’s app on your smartphone to perform internet banking
• Report cyber incidents to ASD’s ACSC.

The Victorian Chamber’s library of business tools and templates includes important cyber resources, including the Small Business Cyber Security Checklist with tips on how to protect your business and customers.

Our CyberSimple suite of affordable, online, self-paced cyber safety programs also partners with cyber industry leading companies to unsure businesses and employees learn key cyber security concepts and how to stay safe.

Importance of joint efforts

The report highlights the importance of government and industry partnerships in combatting cyber threats through intelligence sharing, combining insights and capabilities to block and counter these threats.

ASD’s Cyber Security Partnership Program has grown to over 133,000 partners and the Cyber Threat Intelligence Sharing network now shares millions of indicators of compromise with hundreds of Australian partners. Australian businesses and organisations are encouraged to join ASD’s Partnership Program at cyber.gov.au.

Minister for Defence Richard Marles said: “ASD’s Annual Cyber Threat Report sharply illustrates that the nation faces an increasingly challenging threat landscape where cyber-enabled espionage and crime are not a hypothetical risk, but a real and increasing danger to the essential services we all rely on.

“The report makes clear that malicious actors have been working unseen to steal data and demand ransom payments from Australian victims, or to target our most critical networks for disruptive attacks.

“ASD’s annual assessment again shows the urgency of industry and government working collaboratively to raise our collective cyber defences and protect the digital arteries so essential to the nation and our economy.”

Read the full 2024-25 Annual Cyber Threat Report.

Victorian Chamber of Commerce Executive Director ICT Glenn Goodwin said: “ASD’s Annual Cyber Threat report highlights the continuing and escalating threat that cyber crime poses to all Australian businesses. Large businesses hardening of cyber defences is shifting focus of opportunistic cyber criminals to weaker small businesses that are often easier targets.

"The time is now for small businesses to ensure they are protected by starting their cyber journey by confirming that multifactor authentication, automated updates, and backups are fully implemented. Use cyber.gov.au and Victorian Chamber resources to harden your cyber defences and raise staff awareness of the cyber risks.”