Cyber threats targeting Australian organisations are increasing in both frequency and impact — and the data shows that small and medium-sized businesses are not exempt. The ASD's own analysis confirms that basic cyber hygiene failures account for a significant proportion of successful intrusions, and that implementing basic mitigations can prevent the majority of incidents. This article covers the threats driving the increase, the entry points most relevant to back-office teams, and the five practices the ASD identifies as the most effective starting point for any organisation.

ASD Threat Landscape: Why Cybercrime Hits Australian Businesses Every 6 Minutes

Australia's cyber threat environment intensified significantly in the 2024-25 financial year. According to the Australian Signals Directorate's Annual Cyber Threat Report 2024-25, ASD's Australian Cyber Security Centre received over 84,700 cybercrime reports — an average of one every six minutes. The ACSC responded to over 1,200 cyber security incidents, an 11 per cent increase from the previous year. Notifications to organisations of potentially malicious cyber activity increased by 83 per cent.

The Office of the Australian Information Commissioner reported in July 2026 that data breach notifications reached an all-time high in 2025, the highest number recorded since the Notifiable Data Breaches scheme commenced in 2018. Beyond operational disruption, data breaches carry significant legal obligations under the Privacy Act 1988 — including notification requirements that apply when personal information is compromised.

Ransomware, credential theft and phishing are driving the increase

The ASD report identifies credential theft, phishing, and ransomware as the most pervasive threats facing Australian organisations. Artificial intelligence is compounding the threat, enabling malicious cyber actors to execute attacks at a larger scale and faster rate — including more convincing phishing messages that are harder to identify as fraudulent.

This is not only a large-organisation problem

The scale of incidents reported to the ACSC spans organisations of all sizes. Small and medium-sized businesses are represented throughout the data, and the ASD report makes clear that basic cyber hygiene failures — not just sophisticated attack techniques — account for a significant proportion of successful intrusions. The report notes that implementing basic mitigations can prevent the majority of cyber incidents reported to ASD's ACSC.

For back-office teams in particular, the relevance is direct: credential theft, phishing, and third-party risk are not threats that require a technical response team to address at the point of entry. They are threats that are frequently initiated through the actions — or inactions — of individual employees.

Top 3 Cyber Entry Points Target Accounts Payable, HR & Payroll

The ASD Annual Cyber Threat Report 2024-25 identifies the attack methods most commonly used against Australian organisations. Three of them are particularly relevant to back-office teams, because they rely on human behaviour as much as — or more than — technical vulnerabilities.

Credential theft

Credential theft is one of the most pervasive threats identified in the ASD report. Cybercriminals obtain usernames and passwords — often purchased from the dark web following previous breaches at other organisations — and use them to access email accounts, cloud services, financial platforms, and corporate networks. The point of entry is frequently an account where a password has been reused across multiple services, or where multi-factor authentication is not enabled.

For back-office teams, this means that the security of a payroll system, accounting platform, or HR database may depend in part on whether individual employees are reusing passwords across personal and work accounts.

Phishing

Phishing remains the most common method used to initiate cyber attacks against Australian organisations. Employees receive fraudulent emails, text messages, or links designed to appear legitimate — from a supplier, a financial institution, or an internal system — and are directed to enter credentials or open attachments that install malicious software.

The ASD report notes that AI is enabling cybercriminals to produce phishing messages at greater scale and with greater accuracy than previously possible. Messages that were once identifiable by poor grammar or implausible scenarios are increasingly difficult to distinguish from legitimate communications.

Back-office functions — accounts payable, HR, payroll — are frequently targeted because they hold financial authority, access to personal information, or both.

Third-party and supply chain risk

The ASD report identifies third-party risk management as one of its four priority recommendations for Australian organisations. Attackers increasingly target the vendors, cloud platforms, and service providers that businesses rely on, gaining access to multiple organisations through a single point of compromise.

For back-office teams, this risk is present in the software tools and platforms used daily — accounting software, payroll systems, cloud storage, email providers. Where a vendor's security is compromised, the data and access held within those platforms may be exposed regardless of the organisation's own internal controls.

The ASD report recommends that organisations actively manage third-party risk rather than treating vendor security as the vendor's responsibility alone.

5 Essential Cyber Hygiene Habits Recommended by ASD for 2026

The ASD Annual Cyber Threat Report 2024-25 states that implementing basic cyber security mitigations can prevent the majority of cyber incidents reported to ASD's ACSC. The following five practices are drawn directly from the ASD's own recommendations and are designed to be actionable without specialist technical knowledge.

Back-Office Cyber Hygiene: Quick Reference

1. Enable multi-factor authentication on every account

Multi-factor authentication (MFA) is the single most effective control for preventing unauthorised access to accounts. When MFA is enabled, a stolen or guessed password alone is not sufficient to gain entry. An attacker also needs access to a second factor, such as an authentication app or a code sent to a trusted device.

The ASD recommends using strong MFA wherever possible. For back-office teams, this means enabling MFA on email, cloud storage, accounting software, payroll platforms, HR systems, and any other tool used for work. Where a platform offers MFA and it has not been enabled, that is the highest-priority item to address.

2. Use strong and unique passwords or passphrases

Reusing passwords across multiple accounts is one of the primary enablers of credential theft. When a password is exposed in a breach at one service, attackers test it against other services. This technique, known as credential stuffing, is one of the primary enablers of unauthorised account access. Using a different, strong password or passphrase for each account eliminates this risk.

A password manager removes the need to remember multiple complex passwords and makes it straightforward to maintain unique credentials across all accounts. The ASD recommends using strong and unique passwords or passphrases as a foundational security practice.

3. Keep software and devices up to date

Unpatched software is one of the most common entry points for attackers. Software vendors regularly release updates that fix security vulnerabilities — delaying those updates leaves known weaknesses in place. The ASD recommends keeping software on all devices updated as a basic and essential control.

For back-office teams, this applies to operating systems, browsers, email clients, accounting and HR software, and any other applications used for work. Enabling automatic updates where available is the simplest way to maintain this practice consistently.

4. Be alert to phishing messages and scams

Phishing is the most common method used to initiate attacks against Australian organisations. Recognising the signs of a phishing attempt is a skill that reduces risk across the entire organisation.

Common indicators include unexpected requests for credentials or payments, a sense of urgency designed to prompt action without reflection, sender addresses that do not match the claimed organisation, and links that lead to unfamiliar websites. When in doubt, verify a request through a separate channel — by calling the sender directly using a known number — rather than responding to the message itself. Suspicious messages should be reported to IT or management rather than simply deleted.

5. Back up important data regularly

Regular backups are the primary recovery mechanism when data is lost, encrypted by ransomware, or deleted. A backup that is current, complete, and stored separately from the primary system can mean the difference between recovering from an incident and losing data permanently.

The ASD recommends regularly backing up important data as a fundamental practice. For back-office teams, this applies to financial records, HR data, contracts, and any other information that would be difficult or impossible to reconstruct. Backups should be tested periodically to confirm they can be restored successfully.

The ASD confirms that implementing basic cyber security measures can prevent the majority of incidents. The ACSC's Small Business Cyber Security Guide and the Essential Eight framework provide structured next steps. For specific advice on assessing or improving an organisation's security posture, consult a cyber security specialist or contact the ACSC directly.

Official sources:

• ASD — Annual Cyber Threat Report 2024-25

• OAIC — Data breach notifications increase to all-time high in 2025

• ACSC — Small Business Cyber Security Guide

• ACSC — Practical cyber security tips for business leaders

• ACSC — Essential Eight

• ACSC — Alerts and advisories

• ACSC — ReportCyber

Last updated: August 2026