CriticalRansomware
Australia’s Annual Cyber Threat Report 2025-26 Shows Cyber Incidents Up 20%
SOCRadar·Source published ·1 min read
What happened?
Australia’s cyber security authority responded to 1,524 cyber security incidents in the 2025-26 financial year, a 20% increase from the previous year and a 36% rise over five years. The latest Annual Cyber Threat Report shows that phishing, compromised accounts, unpatched systems, ransomware and data theft remain the main operational pressures.
Key details
- ASD's ACSC responded to 1,524 cyber security incidents in 2025-26, a 20% increase from the previous year and 36% over five years.
- Data breach incidents handled by ASD's ACSC rose 66% to 98, while OAIC received 1,205 breach notifications, its highest annual total since the scheme began.
- Phishing appeared in 39% of analysed incidents, followed by compromised accounts at 21%, user execution at 17%, valid accounts at 15%, and social engineering at 13%.
Affected
- Federal government accounted for 32% of incidents reported to ASD's ACSC, state and local government 16%.
- Health Care and Social Assistance was the leading non-government sector at 7% of incidents, with Manufacturing entering the top ten and recording the largest increase.
- Victoria accounted for 27% of cybercrime reports, Queensland 26%, and New South Wales 22%.
Fixes and mitigations
- Accelerate patching of internet-facing and actively exploited vulnerabilities, replace unsupported technology, and verify remediation in production.
- Use phishing-resistant authentication, restrict privileges, secure recovery processes, and monitor unusual token or session use.
What to look for
- Proactive warnings about cPanel vulnerabilities sent to 340 entities resulted in more than 60 confirmed incidents.
- Akira ransomware investigation linked activity to exploitation of a known SonicWall vulnerability, leading to identification of almost 1,000 potentially vulnerable devices.
- China-nexus actors increasingly use covert networks built from compromised SOHO routers, IoT devices, and smart devices to conceal malicious activity origin.
- Shai-Hulud campaign compromised a maintainer account, harvested credentials and cloud metadata, exposed stolen secrets in public repositories, and used captured access to compromise other packages.
Summarised by SecOraLens from SOCRadar. Always read the original source before acting. How SecOraLens verifies advisories.