Australian Signals Directorate annual cyber threat report for 2024-25 shows 11 per cent rise in cyber security incidents

The Australian Signals Directorate confronted 1200 cyber security incidents over the past year as the pace of cyber attacks against Australian businesses and governments continues to escalate. The 1200 figure, revealed as part of the ASD’s Annual Cyber Threat Report for 2024-25, marks an 11 per cent increase on the prior year. Defence Minister Richard Marles warned the nation faced “an increasingly challenging threat landscape”. “The nation faces an increasingly challenging threat landscape where cyber-enabled espionage and crime are not a hypothetical risk, but a real and increasing danger to the essential services we all rely on,” he said. “The report makes clear that malicious actors have been working unseen to steal data and demand ransom payments from Australian victims, or to target our most critical networks for disruptive attacks.” The report, released on Monday, details a sweep of disturbing trends, with every major business and sector now at risk from potentially crippling attacks. For one, the number of ransomware incident in the healthcare sector doubled in 2024-25 from the previous year. Malicious cyber actors were successful in 95 per cent of all health care and social assistance sector incidents that the ASD responded to, the report adds. Further, the costs to businesses from cyber attacks are exploding. The average self-reported cost of cyber crime per for report for small business is now $56,600, up 14 per cent. For medium-sized businesses, the cost has jumped 55 per cent to $97,200, while for large businesses, reported costs have skyrocketed 219 per cent to $202,700. “Businesses should operate with a mindset of ‘assume compromise’ and prioritise the assets or ‘crown jewels’ that need the most protection,” the ASD states in its report. Attacks flow from a range of state-based actors and also criminal enterprises, the report states. A Chinese group called Advanced Persistent Threat (APT) 40 is singled out as a key state-backed aggressor. “APT40 regularly conducts malicious activities against Australian and regional networks that possess information of value to the People’s Republic of China,” the report states. “These activities represent a security threat to many government and critical infrastructure networks. “Australia and several international partners acted decisively to detail the tradecraft of APT40 to assist network defenders to detect and prevent their malicious activities.” State-based actors “routinely target” Australia’s critical infrastructure, the ASD adds, to conduct espionage or to “preposition for disruptive and destructive cyber effects” in the event of a future conflict. Over the year, the report reveals that cyber actors achieved “extensive compromise” on two occasions in the federal government, government shared services and regulated critical infrastructure categories. The report comes two days after criminal hackers released stolen Qantas customer data onto the dark web following a cyber hit on the airline giant’s operations in Manila in July. Stolen data includes names, phone numbers, addresses, emails, birthdays, gender, frequent flyer numbers, status tiers and points balances. No credit card details, personal financial information or passport details were accessed in the breach. The airline said it was investigating the incident with cyber security experts, the Australian government, the ASD’s Australian Cyber Security Centre and the AFP.