Cyber security incidents double between 2019-20 and 2021-22

More than two in 10 businesses (22 per cent) experienced a cyber security attack during the 2021-22 financial year, compared to almost one in 10 (8 per cent) in 2019-20, according to new data released today by the Australian Bureau of Statistics (ABS).

Robert Ewing, head of ABS business statistics, said: “Today’s Characteristics of Australian Business data release is important because it gives governments and researchers information about the prevalence, impacts and nature of cyber attacks. This helps them understand who they need to support and what strategies they need to use.”

The types of cyber attacks included, scams or fraud (16 per cent), malicious software infecting computers (5 per cent) and unauthorised access or use (3 per cent).

The latest figures also show how cyber attacks impacted businesses. In 2021-22 just over half of those that experienced a cyber attack were negatively impacted, compared to more than 80 per cent of businesses in 2019-20.

“In 2021-22, 34 per cent of businesses reported loss of time in managing cyber security attacks, 18 per cent reported downtime of service, while 17 per cent reported a loss of staff productivity,” Mr Ewing said.

For the first time, all businesses were asked about the types of cyber security measures they had in place, and seven in 10 (70 per cent) reported some form of protection measure.

“Over 60 per cent of businesses reported regular updates to virus protection software. Around 37 per cent of businesses regularly backed up operations-critical data, while 20 per cent had identity access management and 13 per cent gave staff cyber security awareness training,” Mr Ewing said.