BDO and AusCERT Cyber Security Survey Report 2021

Cyber Incidents - Public Sector

Public Sector (Federal, State and Local Government) experienced the highest level of cyber incidents in 2021. Phishing and targeted malicious emails continue to be the major weapon for cyber criminals in this sector, followed by unauthorised access of information by external users and third-party breaches. Highlighting the trend that criminals will target a potentially weak link in the chain, rather than launch a sophisticated attack.

(Click to expand graph)

Cyber Incidents - Not-For-Profit

Cyber attacks on not-for-profit (NFP) organisations continues to rise. Many NFP organisations process or store sensitive personal information and can easily become a target for criminals. However, given the nature of their business model, the finances and resources to manage the cyber threat are not always in abundance, or the funds are directed to other more important areas.

(Click to expand graph)

Cyber Incident - Private sector

Private companies have traditionally prepared for cyber attacks through increasing investments on cyber security controls, considering the type and amount of information they hold for their customer and clients.

While the targeted phishing email attacks have reduced compared to last year, it continues to be one of the major threat vectors followed by data breaches from cyber attacks on third-party service providers. The data exceeded the expectations for the year, thus requiring additional emphasis around employee awareness and controls around third-party service providers.

(Click to expand graph)

Cyber Incidents - Listed

Compared to last year, reported or known attacks on publicly listed companies have reduced. However, these companies continue to remain on the target list of hackers considering the nature of business, size of the organisation, and stakeholder's information they possess. It becomes increasingly important for these organisations to direct more efforts and resources in managing cyber risks to ensure better preparedness against cyber attacks.

(Click to expand graph)

Data breaches - Financial and Insurance services

The financial services and insurance sector faced the largest number of data breaches in 2021, highlighting the focus this area has been given from Australian Prudential Regulation Authority (APRA) and Australian Securities and Investments Commission (ASIC) to improve the overall control posture and resiliency.