Cybercrime Now Costs Medium Businesses $141,300 Per Report

The short answer: The Australian Signals Directorate’s Annual Cyber Threat Report 2025-26 found the average self-reported cost of cybercrime for medium businesses rose 45 per cent to $141,300 per report. AI is making attacks faster and more convincing, so the controls that matter most are the ones that stop money leaving on the strength of an email alone.

Key takeaways

• ASD received more than 82,000 cybercrime reports in 2025-26, about one every six minutes.
• Medium businesses: $141,300 average cost per report (up 45 per cent). Small: $55,400. Large: $148,100 (down 27 per cent).
• ASD calls AI “the defining force” in the threat landscape this year.
• ASD disrupted a business email compromise campaign that used more than 400 look-alike domains to push urgent payments.
• Verify the business, the person and the bank account before any payment, not after.

What did the ASD cyber threat report 2025-26 find?

The ASD cyber threat report 2025-26 found that cybercrime is steady in volume but more expensive for businesses, especially mid-sized ones. Released on 27 October 2026 (cyber.gov.au), the report counts more than 82,000 cybercrime reports, more than 1,500 incidents responded to, and over 4,400 notifications to Australian organisations about potentially malicious activity, almost an 80 per cent increase on last year (ASD).

The average self-reported cost per business report rose 16 per cent to $93,500. Medium businesses took the sharpest jump: up 45 per cent to $141,300, close to the $148,100 reported by large businesses, whose figure fell 27 per cent.

The Australian Financial Review’s coverage led with ASD director-general Abigail Bradshaw’s warning that legacy technology remains one of the country’s “most persistent” vulnerabilities, and that “Australia must accelerate the modernisation of its technology and cybersecurity foundations” (AFR).

Why are medium businesses being hit hardest?

The report does not give a single reason, so treat this as our reading rather than ASD’s finding. Medium businesses tend to move large sums to many suppliers, but often run finance with a small team, shared inboxes and manual approval steps. That combination of real money and thin controls is exactly what payment fraudsters look for.

How is AI changing the attacks?

ASD says AI is letting malicious actors work “with greater scale, speed and sophistication”, making scams and phishing “more efficient, effective and convincing”. In practice, the spelling errors and awkward phrasing staff were trained to spot are disappearing. An email asking you to update a supplier’s bank details can now read exactly like the real supplier. (We covered the wider trend in AUSTRAC: Scams Now Cost the World More Than Narcotics.)

What does a modern payment fraud attempt look like?

One case study in the report shows it plainly. In December 2025, ASD identified a business email compromise campaign using more than 400 look-alike domains impersonating Australian construction companies. No accounts were hacked. The attackers registered domains that looked like trusted businesses and sent emails urging victims to make urgent payments. ASD shared 423 confirmed malicious domains with partners to block them.

That matters because many payment controls assume fraud starts with a compromised mailbox. Look-alike domains skip that step entirely. Read more in our business email compromise guide and on AI-powered fraud.

The check before any payment

Whatever the email looks like, three checks stop most redirection attempts before money moves:

1. The business is real. Confirm an active ABN that matches the supplier you think you are paying (ABN verification before payment).
2. The person is who they say they are. Confirm any bank detail change through a contact you already hold, never the one in the email.
3. The BSB and account number belong to that business. Name matching alone (Confirmation of Payee) helps, but it does not prove ownership (bank account ownership verification).

ezyshield does that third check live, before the payment is released, so a convincing email is not enough to move money.

Want to know what one redirected payment would cost you? Run the numbers in the free Fraud Cost Calculator, or check a suspicious sender with the BEC Email Checker.

What should finance teams do this week?

• Lock the rule: no bank detail change is actioned from email alone.
• Ask your IT team whether look-alike domain alerts are switched on for your own domain and your top suppliers.
• Check that verification happens at the moment of payment, not only at supplier onboarding (how to verify a supplier’s bank account).
• Report suspicious activity to ReportCyber or the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371).

FAQ

What is the ASD Annual Cyber Threat Report? It is the Australian Signals Directorate’s yearly assessment of cyber threats to Australia. The 2025-26 edition covers the financial year to June 2026 and focuses on AI’s impact.

How much does cybercrime cost a medium business in Australia? According to ASD’s 2025-26 report, the average self-reported cost per cybercrime report for medium businesses was $141,300, up 45 per cent on the previous year.

How often is cybercrime reported in Australia? ASD received more than 82,000 cybercrime reports in 2025-26, about one every six minutes.

Does Confirmation of Payee stop business email compromise? It helps by checking whether the account name matches, but it is name matching only. It does not confirm the account belongs to the business you intend to pay.

Fraudsters only need one convincing email. You only need one check before the money moves.