ASD's ACSC records 20% rise in cyber incidents from FY25

The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) responded to more than 1,500 cyber security incidents in FY2025–26, a 20% increase on the previous year and a 36% rise over five years, according to the agency's 2025–26 Annual Cyber Threat Report.

The centre also issued more than 4,400 notifications to entities about potentially malicious cyber activity during the period - an 80% jump on FY2024–25. Those notifications included more than 2,200 individual alerts and collective notifications to more than 2,100 entities.

State-sponsored cyber actors remained a persistent threat, the report found, targeting Australian organisations - including critical infrastructure operators, private businesses and individuals - primarily to access sensitive or non-public information.

The ASD's ACSC said these actors are increasingly seeking to pre-position within networks to enable future intelligence collection, disruption or access to higher-value targets at a time of their choosing, a trend it linked to multiple global conflicts currently underway.

Compromised accounts and credentials also emerged as one of the most frequently reported incident categories across government, industry and critical infrastructure sectors.

The report attributed this to the value malicious actors place on legitimate access to networks and systems, and noted that artificial intelligence has amplified the effectiveness of social engineering techniques - enabling more convincing impersonation and manipulation of individuals and businesses for financial gain or network access.

Australian individuals also had personally identifiable information (PII) exposed in a growing number of global data breaches, with the data subsequently held to ransom, sold or published online.

The ASD's ACSC released its Essentials series earlier this month, evolving the Essential Eight into a principles-based framework designed to provide prioritised, threat-informed guidance tailored to different technology environments.

The agency described the update as a necessary reflection of advances in threats, mitigation technologies and the diversity of networks and operating systems.

The report renewed calls for organisations to reduce legacy IT exposure, implement event logging, manage supply chain risk and prepare for post-quantum cryptography (PQC).

The ASD's ACSC said organisations should cease using traditional asymmetric cryptography by the end of 2030 at the latest, noting that AI could accelerate developments in quantum computing that would undermine current encryption. .

The ASD's ACSC also recommended individuals and organisations implement basic cyber security practices including reviewing privacy settings and enabling passwordless authentication such as multi-factor authentication (MFA) or passkeys to reduce the risk of cybercrime.