Report the incident to ReportCyber, the Australian Signals Directorate's national reporting portal, then tell your insurer and, where personal information was involved, assess the breach under the Notifiable Data Breaches scheme. In 2025-26 Australians made more than 82,000 cybercrime reports to ReportCyber - about one every 6 minutes - and a report is what puts an incident into the national picture and, for an individual business, starts the response record an insurer and regulator will ask to see. This guide covers what to report, where, and in what order.
TL;DR
- Report cybercrime to ReportCyber (cyber.gov.au) - the ASD's national reporting portal.
- Report immediately if money or data is at risk; your bank first if funds have moved.
- Personal information breached? The Notifiable Data Breaches scheme applies - assess within 30 days, notify if eligible.
- Also notify: cyber insurer, your IT provider or MSP, and any affected partner.
Where to report
- ReportCyber (cyber.gov.au/report) is the ASD's national online reporting portal for cybercrime and cyber security incidents. It is the first port of call for businesses and individuals.
- The Australian Cyber Security Centre (ACSC) - part of ASD - provides incident response advice for businesses; reports made through ReportCyber are handled within it.
- IDCARE (idcare.org, 1800 595 160) supports individuals whose identity information was exposed.
- Scamwatch (scamwatch.gov.au) collects scam reports that help pattern-spotting, but it does not replace a ReportCyber report.
Step by step: the first 24 hours
- If funds have moved, call your bank first. Banks can sometimes freeze or recall recent transfers - hours matter.
- Contain the incident. Disconnect affected devices, reset credentials for affected accounts, revoke suspicious sessions and app access.
- Preserve evidence. Keep the suspicious emails, screenshots, logs and transaction records before cleanup wipes them.
- Report to ReportCyber. Have ready: what happened and when, systems and accounts affected, whether money or data was taken, and any reference numbers your bank or IT provider gave you.
- Notify your cyber insurer if you hold a policy - many require notification within a set window and will appoint an incident response provider.
- Engage your IT provider or MSP to scope the compromise, close the entry point and check whether other accounts or systems are affected.
- Notify affected partners or clients where a breach of their data or systems is involved.
Notifiable Data Breaches: the 30-day rule
If personal information your organisation holds was involved, the Privacy Act's Notifiable Data Breaches (NDB) scheme applies. The obligations:
- When there are reasonable grounds to suspect an eligible data breach, you must complete a reasonable and expeditious assessment within 30 calendar days of becoming aware of the grounds for suspicion.
- If the assessment confirms a breach is likely to result in serious harm to affected individuals, you must notify the OAIC and those individuals as soon as practicable.
- The 30 days is an assessment window, not a notification deadline; the OAIC expects assessments completed in a shorter time where facts allow.
- Keep a dated record of the assessment and decision - the OAIC may ask how and when you assessed.
What to include in a ReportCyber report
- Date and time the incident was discovered, and when it started.
- Type of incident: ransomware, business email compromise, invoice fraud, account compromise, data theft.
- Systems, accounts and data affected.
- Financial loss, if any, and whether a bank is involved.
- Actions already taken: containment, credential resets, insurer notified.
- Any attacker contact details, wallet addresses or accounts used.
Who else to tell
- Your bank - for payment fraud, even if funds have not moved yet; banks monitor flagged accounts.
- Your cyber insurer - policy conditions often require early notice.
- Your IT provider / MSP - for containment and forensics.
- ASIC - for business name or company details being impersonated.
- State police - where there is immediate physical threat or theft involved, alongside ReportCyber.
After the report: closing the gap
A report is the start of the record, not the end of the work. The same incident should trigger a review of what let the attacker in - usually a phishing email or compromised credential - and a plan to close it. A phishing simulation programme tests whether staff would fall for the same lure again, and a cyber security gap assessment maps the control gaps the incident exposed. Human risk reporting turns the training response into evidence for your insurer and board.
FAQ
Do I have to report a cyber attack in Australia? For most private businesses, reporting to ReportCyber is not legally mandatory - but it is strongly encouraged, free, and produces the record insurers, banks and courts ask for. Notification is mandatory where the Notifiable Data Breaches scheme applies to personal information, and for critical infrastructure entities under the SOCI Act.
Is reporting anonymous? You provide contact details so ASD can follow up, but reports are treated confidentially and are not shared with the attacker or used against you.
How quickly should I report? As soon as containment allows - ideally within 24 hours. For payment fraud, the bank comes first because recall windows are short.
What if the attack came through my MSP or supplier? Report through your own ReportCyber report, notify your insurer, and coordinate with the supplier. Your obligation to assess any personal-information breach under the NDB scheme is yours regardless of who was breached first.
Related guides
- What counts as a notifiable data breach in Australia
- How to report a suspicious email at work
- How to run a security gap assessment for small business