Cybercrime reports have dropped but businesses face a bigger financial impact from them, the Australian Signals Directorate's annual cyber threat report reveals.
The average cost of cybercrime to large businesses was $202,700 in the past financial year, up 219 per cent on the previous year, and an average of $97,200 for medium-sized businesses, up from 55 per cent, the report published on Tuesday shows.
The average cost of cybercrime for small businesses was $56,571.
The directorate received 84,700 reports of cybercrime over the past financial year, down three per cent on the previous 12 months.
The agency's director-general Abigail Bradshaw said ransomware and identify fraud remained the most disruptive and common cyber crime threat.
"Australia is increasingly targeted by cybercriminals looking to steal credentials," Ms Bradshaw said.
"Once access is gained, they mimic legitimate user behaviour to steal sensitive personal or corporate information, install ransomware or malware and take over accounts."
Networks are increasingly being breached through compromised or stolen details to gain unauthorised access, rather than being hacked.
These types of breaches account for 42 per cent of incidents impacting large organisations, government or supply chains and highlight the need to set up multi-factor authentication instead of solely relying on username and passwords.
The agency responded to 128 ransomware incidents, consistent with last year, with these types of cybercrimes labelled as the "most disruptive" threat.
It comes as the data of 5.7 million Qantas customers was posted online after hackers from Scattered LAPSUS$ Hunters made good on a ransom threat.
The airline was one of six global companies to have its data released at the weekend, and included customers' full names, email addresses and Frequent Flyer details.
The incident was not included in the report because it happened in the current financial year.
The report also warned artificial intelligence may also create an avenue for cybercriminals to carry out threats, such as creating fake voices, websites, and customer records to present themselves to victims as legitimate.
Cyber-enabled espionage posed a "real and increasing danger" to Australia's essential services, Defence Minister Richard Marles said.
"The report makes clear that malicious actors have been working unseen to steal data and demand ransom payments from Australian victims," Mr Marles said.
10°C