The Australian Signals Directorate (ASD) received a new incident report every six minutes last year, the agency has revealed in confirming that the cost of cyber crime to small businesses and individuals continues to rise amidst deteriorating global relations.
The average cost of a cyber crime incident for small businesses rose by 8 per cent to $49,600 per reported incident, the ASD’s Annual Cyber Threat Report for 2023-24 confirmed, with individuals losing an average $30,700 per report, up 17 per cent.
Overall, the agency received more than 87,000 reports of cyber crime and 36,700 calls to its Australian Cyber Security Hotline – 100 per day, up 12 per cent on the previous year – and responded to 1,100 incidents during the course of the year.
Reports spanned the gamut of attacks, ranging from general phishing attacks to sustained attacks by malicious state and non-state cyber actors – who in 11 per cent of cases, the report found, targeted their attacks at Australian critical infrastructure.
Countering this threat requires “the continuing cooperation of Australian businesses and individuals,” Minister for Defence Richard Marles said, adding that the report’s findings highlight the value of “genuine” public-private partnerships.
Tough measures for tough times
The figures – which come as aggressive cyber actor Russia threatens nuclear retaliation for Ukraine’s use of US missiles to attack it, and continuing conflict in the Middle East – carry an ASD warning that “malign actors are improving their cyber capabilities.”
ASD cyber specialists have also seen increasing ‘grey-zone’ activities across the Indo-Pacific region, Marles warned, with “entrenched strategic competition” seeing “malicious cyber actors continuing to conduct espionage and spread disinformation.”
That included the finding that Chinese cyber actors are using ‘living off the land’ tactics – probing networks using legitimate network tools to avoid detection – as “pre-positioning for disruptive effects rather than traditional cyber espionage operations.”
Grey-zone warfare standout Russia is also “adapting its techniques,” the report warns, “including for the exploitation of cloud platforms.”
“The evolution of this tradecraft means that network defenders must prioritise and invest in cyber security skills, resources, and teams.”
Types of cybercrime are evenly distributed
Interestingly, while the self-reported cost of the average small business breach climbed during the year, the cost to medium and large businesses declined by 35 per cent and 11 per cent, respectively – suggesting that such organisations’ defences are improving.
Identity fraud was involved in 26 per cent of reports by individuals, who were also reporting high incidence of online shopping fraud (15 per cent) and online banking fraud (12 per cent).
Businesses, by contrast, were being hit most frequently by compromises of email accounts – which were involved in 1 in 5 reported incidents – and had similar levels of online banking fraud (13 per cent) and business email compromise fraud (13 per cent).
Understanding the types of attacks targeting Australians helps the ASD refine support measures such as the Australian Protective Domain Name System, which saved customers from accessing 82 million malicious domains, up 21 per cent over last year.
The ASD’s Domain Takedown Service requested the removal of over 189,000 malicious domains – up 49 per cent on the previous year – while the ASD’s Cyber Hygiene Improvement Program engaged with an average of one new organisation per day.
The ASD also saw strong growth in programs such as its Cyber Threat Intelligence Sharing program – which during the year grew by two-thirds to over 400 partners, who collectively shared nearly 1.4 million indicators of compromise.
“Reporting cybercrime, incidents and vulnerabilities remains a critical part of building a national threat picture,” Marles said, “and enabling us to effectively counter malicious cyber actors.”
Cyber security “is our fastest growing threat,” Minister for Home Affairs and Cyber Security Tony Burke said, “and we need to use all the tools available to government and business to confront it…The work is never done.”