Australia’s 2025-26 Cyber Threat Report Records a 20% Rise in Incidents

Summary

Australia’s 2025-26 report says ASD’s ACSC handled 1,524 incidents, up 20%. Extensive compromises rose despite broadly stable ransomware volume; phishing, compromised accounts and unpatched systems remained major pressures.

Key points

ASD’s ACSC handled 1,524 cyber security incidents, up 20% year over year and 36% over five years; it also issued more than 4,400 proactive warnings.
Extensive compromises rose from 26 to 40. Ransomware incidents remained broadly stable at 139, while extensive ransomware incidents increased from 16 to 24.
Phishing appeared in 39% of analysed incidents and compromised accounts in 21%; the report notes that technique percentages overlap.
ASD’s ACSC responded to 98 data breach incidents, up 66%. It says most vulnerability exploitation occurs within two weeks of guidance, with some exploitation within 48 hours.
A cPanel vulnerability notification to 340 entities led to more than 60 confirmed incidents. In an Akira investigation, reports helped connect activity to a known SonicWall vulnerability and prompted warnings about potentially vulnerable devices and organisations.
The report describes AI as accelerating established techniques, including phishing and vulnerability research, rather than creating a separate attack type.
Recommended priorities include faster patching, stronger identity and session controls, improved logging, tighter supplier and software access, tested recovery plans and governed AI use.

Article Details

Publisher: SOC Radar
Report Period: 2025-26 financial year
Scope: Cyber incidents, cybercrime reports, ransomware, data breaches, vulnerability exploitation, and threat trends affecting Australia.
Key Statistics: ASD’s ACSC responded to 1,524 cyber security incidents, up 20% from the previous year.
ASD’s ACSC issued more than 4,400 notifications about potential malicious activity, up almost 80%.
More than 82,000 cybercrime reports were submitted through ReportCyber, approximately one every six minutes.
ASD’s ACSC responded to 139 ransomware incidents; extensive ransomware incidents rose from 16 to 24.
ASD’s ACSC responded to 98 data breach incidents, up 66%.
Recommendations: Prioritise patching internet-facing and actively exploited vulnerabilities, replace unsupported technology, and verify remediation in production.
Protect identities and sessions with phishing-resistant authentication, restricted privileges, secure recovery processes, and monitoring for unusual token or session use.
Retain identity, endpoint, cloud, application, and network logs needed to assess access, impact, and data exposure.
Map third-party access, software dependencies, privileged integrations, repositories, and secrets; test token revocation and containment.
Test incident response and recovery, and define how critical services will continue during system outages.