Cybercrime Costs Australian Small Businesses $55,400 on Average — and the Damage Goes Beyond the Invoice

The Headline Number Is Only the Beginning

The Australian Signals Directorate’s 2025–26 Annual Cyber Threat Report puts the average self-reported cost of cybercrime for small businesses at $55,400**; for medium businesses, **$141,300 — up 45% year-on-year. Those figures are stark enough on their own. But for an SME, the invoice is often the least damaging part of an incident.

Insurance claims data from 2026 tells a more granular story. Business email compromise (BEC) remains the dominant SME cyber claim type, with an average BEC claim cost of $36,250 between 2023 and 2025**, and the **average social engineering theft claim at $27,300. The average 2026 ransomware claim exceeds $140,000. These are not enterprise-scale losses — they are precisely calibrated to the operating margins of a small firm.

Ransomware Actors Are Targeting the Bottom of the Market

Leak-site data shows Australian SMBs account for 71% of ransomware victims. This is not because SMBs are uniquely valuable targets in isolation, but because they are softer targets at scale. A small business with no dedicated security team, no 24/7 monitoring, and no tested recovery plan presents a faster path to payment than a hardened enterprise.

Arctic Wolf’s 2026 research reinforces the operational reality: more than 70% of ANZ SMEs have experienced a significant cybersecurity incident, with productivity losses of up to three weeks. Three weeks of disrupted operations for a business with fewer than 20 employees can mean lost contracts, missed payroll, and reputational damage that never appears in an incident report.

The Claims Data Reveals Where the Money Actually Goes

The 2026 insurance claims picture shows that SMEs are being hit harder not primarily by ransom payments, but by prolonged business interruption and third-party dependencies. A BEC attack that redirects a single supplier payment may cost $36,250 in direct loss — but the downstream cost includes cash-flow disruption, forensic investigation, legal notification obligations, and lost client trust. Those indirect costs do not show up in the headline average, yet they determine whether a small business survives the incident.

The National Anti-Scam Centre recorded 481,523 scam reports in 2025, with 274,577 involving financial losses totalling $2.18 billion. For SMEs, the scam economy and the cyber-incident economy are converging: a convincing AI-generated invoice or a spoofed executive email is both a scam and a security breach, and the financial damage follows the same path.

What the Cost Curve Demands From Small Operators

The businesses that keep incident costs contained are not necessarily the ones with the biggest security budgets. They are the ones that have pre-built a response playbook: who to call, which accounts to freeze, how to verify a payment redirection request, and how to communicate with customers without guessing. ASD’s 2025–26 guidance explicitly encourages businesses to prepare for post-quantum cryptography, implement event logging, and understand AI-enabled cyber threats — but for an SME, the most immediate return comes from payment verification controls and tested business-continuity plans.

The average $55,400 loss is a useful benchmark. The more important number is the one no report can calculate: the revenue a small business never recovers because it was offline for three weeks.