Australian businesses filed more than 84,700 cybercrime reports in FY2024–25 — roughly one every six minutes — and the average self-reported cost to a small business hit $56,600, up 14% on the year before. Behind most of those incidents sits the same first move: a phishing email somebody trusted. This page collects the phishing statistics Australian business owners should actually know in 2026, what each number means for a small team, and where the figures come from.
The headline numbers for 2026
| Statistic | Figure | Source |
|---|---|---|
| Cybercrime reports to ASD's ACSC, FY2024–25 | 84,700+ (about one every 6 minutes) | ASD Annual Cyber Threat Report 2024–25 |
| Average self-reported cost to small business | $56,600 per incident, up 14% year on year | ASD Annual Cyber Threat Report 2024–25 |
| Business email compromise share of business reports | 15% | ASD Annual Cyber Threat Report 2024–25 |
| Global average cost of a data breach | USD 4.99 million, up 12% | IBM Cost of a Data Breach Report 2026 |
| Share of untrained staff who click a simulated phish | 33.2% | KnowBe4 2026 Phishing by Industry Benchmarking Report |
| Share after 12 months of continuous training and testing | 4.2% | KnowBe4 2026 benchmark |
| Losses to payment redirection scams | $14 million in a single year | Scamwatch, ACCC |
Figures marked by source are the publisher's own reported numbers for their latest reporting period; check each source for its exact methodology and window.
What the national reporting numbers show
ASD's Australian Cyber Security Centre is the national clearing house for cybercrime reporting, and its annual threat report is the most cited Australian dataset. The FY2024–25 edition reports:
- 84,700+ reports across the year — a reporting rate of roughly one every six minutes. Every one of those started with a person or business deciding to report rather than delete, which is why building the reporting habit inside your team matters as much as any filter.
- Small business average cost of $56,600, up 14% year on year. For a 10-person business, one incident costs more than a year of training for the whole team many times over.
- Business email compromise at 15% of business reports — the scam that starts with a convincing email about changed bank details or an urgent invoice, not with any technical exploit.
The pattern across years is stable: the volume does not fall, the lures get more convincing, and the cost per incident climbs.
Phishing is still the front door
Global breach data tells the same story from the other side. IBM's 2026 Cost of a Data Breach Report puts the average breach at USD 4.99 million — a record — and names phishing the most common initial attack vector for the fourth year running. An attack that begins with an email costs far less for the attacker to run than one that begins with a zero-day, which is why the volume stays high.
The human failure rates behind that are well measured. KnowBe4's 2026 benchmark, built from 67.7 million simulated phishing tests across 14.5 million users, found 33.2% of untrained employees click a simulated phishing email. After 90 days of training and testing the figure falls to 20.1%; after twelve months of continuous training it reaches 4.2% — an 87% reduction. The same benchmarking shows the largest gains land between months 3 and 12, which is why one-off training produces a spike of improvement that decays, while a monthly programme compounds.
The scams behind the numbers
Three patterns account for most of the damage in Australian phishing reports:
- Payment redirection and invoice fraud. Scamwatch received reports totalling $14 million lost to payment redirection in a single year — a scammer impersonates a supplier or colleague by email and swaps the account details on an invoice. The defence is a callback habit, not better spelling.
- Credential harvesting. A fake Microsoft 365 or Google login page behind a "shared document" link. Anything typed is stolen within minutes and used to pivot into the real mailbox.
- MFA fatigue. Stolen passwords are worthless if multi-factor authentication holds, so attackers spam approval prompts until someone taps "approve". Training covers the rule: never approve a prompt you did not trigger.
What a breach costs when personal data is exposed
When a phishing incident exposes customer data, two clocks start. The OAIC's Notifiable Data Breaches scheme requires organisations covered by the Privacy Act 1988 to notify affected individuals and the regulator when a breach is likely to result in serious harm — notification, credit monitoring, and the legal costs that follow. The IBM report separately measures the detection and escalation component of a breach as one of its largest cost categories. The direct payment lost to the scammer is usually the smallest line item.
Reading the numbers for your own business
Three practical takeaways fall out of the statistics:
- The baseline is worse than most owners assume. One in three untrained staff clicks a phishing email in a test. In a 20-person business, that is six or seven people clicking a real phish before any training — the question is only which one reaches the invoice.
- The improvement curve is real but takes a year. 33.2% to 4.2% over twelve months of continuous training and simulation. Budget and expect a year, and measure the trend with phishing simulations rather than trusting memory.
- Reporting is the number that predicts safety. Teams that report suspicious email fast close the window an attacker has. Report rate is the metric worth tracking monthly — see human risk reporting for how it is measured per person.
FAQ
How many phishing attacks happen in Australia each year? There is no exact count, because most attempts are never reported. ASD's ACSC received more than 84,700 cybercrime reports in FY2024–25 — about one every six minutes — and phishing is a leading entry point across those reports.
What is the average cost of a cyber attack for a small business in Australia? The average self-reported cost to small business was $56,600 per incident in FY2024–25, up 14% on the prior year, according to ASD's Annual Cyber Threat Report.
What percentage of employees click phishing emails? KnowBe4's 2026 benchmark puts untrained click rates at 33.2%, falling to 4.2% after twelve months of continuous training and phishing simulation.
Is phishing still the most common cyber attack? Yes. IBM's 2026 report names phishing the most common initial attack vector for the fourth consecutive year, ahead of stolen credentials and software vulnerabilities.
Where can I report a phishing scam in Australia? Cybercrime goes to ASD via ReportCyber, and scams to Scamwatch, run by the ACCC. Start with your own IT team's report button first — see our guide on how to report a phishing email.