The ASD's ACSC Annual Cyber Threat Report 2024-25 puts the average self-reported cost per business report at A$80,850 in FY2024-25, up 50% in one year. For builders and trades businesses, the expensive event usually is not a locked server.
It is a normal progress claim sent to changed bank details, discovered after the money has gone. Judge Cyber Insurance Australia in 2026 against that loss first, because a general business package often will not pay it.
Table of Contents
- Cybercrime Costs for Australian Businesses in 2026
- What Cyber Cover Pays and What It Leaves Out
- When a Progress Claim Is Quietly Redirected
- Notifiable Data Breaches and Your Other Duties
- Controls That Keep a Cyber Claim Payable
- What Drives Premiums Limits and Excesses
- How to Buy Cover and Notify a Claim
- Arrange Cyber Cover With a Licensed Broker
Cybercrime Costs for Australian Businesses in 2026
The ASD's ACSC Annual Cyber Threat Report 2024-25 received more than 84,700 cybercrime reports, about one every six minutes, and responded directly to more than 1,200 cyber-security incidents, up 11% on the previous year. Use those figures as a budget anchor, not as a prediction for your business.
Average self-reported cybercrime cost by business size, FY2024-25
| Business size | Average self-reported cost | What the figure measures |
|---|---|---|
| Small business | A$56,600 | Cost per cybercrime report |
| Medium business | A$97,200 | Cost per cybercrime report |
| Large business | A$202,700 | Cost per cybercrime report |
| All businesses | A$80,850 | Average cost per business report, up 50% on the prior year |
How to read these averages
These are self-reported averages. They aren't a premium quote and they don't tell you what limit to buy. One diverted payment can sit below the small business average, while forensic work, legal advice and lost time push the total bill above it.
Think of cyber insurance less as a lock on the site gate and more as a specialist repair crew with a legal hotline attached. The lock is your passwords, software and payment checks. The policy may fund people who investigate what happened, advise who must be told and help you keep trading.
Construction firms face this risk through regular office systems. Plans, variations, payroll, supplier invoices, subcontractor bank details, and client contacts are exchanged via email and cloud folders every week. You don't need an advanced server room to have an costly mailbox problem.
In one sentence, cyber insurance is cover that may fund incident response, forensics, legal advice, notification, business interruption and some third-party claims, depending on the wording. It doesn't replace public liability, contract works or professional indemnity. Separate business interruption insurance explained for Australian businesses also shouldn't be assumed to answer a purely digital outage.
Don't start by asking what limit other builders buy. Start by asking which bill would hurt most next month, a redirected payment, a frozen payroll system or a week without access to job files.
The cover map below shows where those bills usually sit.
What Cyber Cover Pays and What It Leaves Out
Which policy is meant to respond
| Loss | Typical cyber policy | Ordinary business policy | What to check |
|---|---|---|---|
| Incident response and forensics | Usually first-party cover | Rarely | Approved vendor panel and consent to spend |
| Privacy notification and legal advice | Often included | Rarely | Sub-limit and who may be notified |
| Cyber extortion or ransom | Often, with conditions | No | Insurer approval before any payment |
| Fraudulent invoice or bank-detail change | Only with a social-engineering or funds-transfer extension | No | Sub-limit, excess and verification condition |
| Business interruption from a system outage | Often after a waiting period | Usually only if physical damage | Waiting period, indemnity period, dependent systems |
| Liability to clients for compromised data | Often, claims-made | Public liability often excludes cyber | Retroactive date and notification clause |
| Theft of tools, materials or site property | No | Property or theft cover | Do not expect cyber to pay |
| Negligent design or professional advice | No | Professional indemnity | Keep PI as a separate policy |
The ASD's ACSC factsheet for critical infrastructure records more than 1,200 cyber-security incidents in FY2024-25, an 11% year-on-year increase, while the average self-reported business cost reached A$80,850. Those events include attacks, breaches and extortion, not just physical damage, so treat cyber as its own wording rather than an assumed part of another policy.
Claims-made cover and the retroactive date
Most Australian cyber placements are claims-made. The claim or circumstance generally must be notified during the policy period, and a retroactive date can exclude breaches that started earlier. An occurrence-based liability policy works differently because it follows when the incident occurred.
That timing matters with email compromise. An attacker may sit in a mailbox before anyone notices a changed rule or missing message. If you switch insurers, check whether the new retroactive date leaves that earlier access uncovered.
The parts buyers commonly overestimate
Ransom cover usually requires insurer approval before money moves. Paying first and asking later can remove that part of the claim. Business interruption may start only after a waiting period, run for a limited indemnity period and stop at a sub-limit. An outage at your cloud, payroll or estimating provider needs a dependent systems grant, because your own network may be untouched.
The biggest gap for builders is still fraud. Many base wordings treat a payment you authorised after being tricked differently from money stolen by direct system intrusion. You may need a specific social-engineering or funds-transfer-fraud extension, often with a lower sub-limit, a separate excess and a condition that changed bank details were verified.
Public liability responds to bodily injury or property damage within its terms, not every privacy claim. Professional indemnity insurance in Australia answers negligent professional services, not a hacked mailbox. Stolen tools, storm damage and a design error therefore stay outside cyber cover even if email played some part in discovering them.
Exclusions to test before you bind
Look for exclusions or conditions covering known circumstances before inception, unmanaged data, failure to maintain controls promised in the proposal, war or state-backed attacks where excluded, and fines or penalties that can't lawfully be insured. Also check territorial limits and whether outsourced providers sit inside the policy definition of your computer system.
Circle four items on any quote before comparing premium: social engineering, sub-limits, retroactive date and waiting period.
When a Progress Claim Is Quietly Redirected
Say a residential builder owes a subcontractor for completed work. Accounts receives an email that looks like the subcontractor's usual progress claim, except the bank details have changed. The message may come from a compromised mailbox or a domain with one letter altered.
Accounts pays A$48,000. A week later the subcontractor asks where the money is. The builder now faces the original debt, a damaged relationship and an urgent question about whether other invoices were touched. Nobody demanded a ransom and nobody encrypted a server.
Reporting on the Australian Cybercrime Survey findings found 25.0% of SME owners and managers reported cybercrime affected their business in the previous 12 months. Reported impacts included operational disruption at 28.7%, additional expenses at 16.4%, information loss at 15.9%, reputational or revenue harm at 14.1% and legal or regulatory consequences at 7.9%.
How the loss happens
The chain is usually simple. Stolen or guessed credentials give an attacker mailbox access. The attacker watches invoice timing, copies the format and sends believable bank details. One busy approver authorises the transfer, and the bank treats it as a payment the business instructed.
That's why ordinary theft cover is a poor fit. A voluntary bank transfer isn't the same event as tools stolen from a ute, even though deception caused both losses. The policy has to grant cybercrime or funds-transfer fraud specifically.
If the right extension exists, cover may help with forensic work to trace mailbox access, legal advice, a bank recall attempt, notification where personal information was exposed and interruption while accounts staff verify every pending payment. Those services can matter even when the bank can't recover the money.
The diverted sum itself may not be repaid in full. A social-engineering sub-limit can be much lower than the main policy limit, and the excess comes off first. A callback condition may also defeat the claim if staff didn't phone a number already on file. For a practical prompt on slowing down before acting, use guidance on confirming unexpected messages and then verify through contact details your office held before the suspicious email arrived.
Dual authorisation and a call-back to a known number work as a pair with the insurance extension. One reduces the chance of payment. The other helps fund the investigation if deception still gets through. Often the valuable part of cyber cover isn't a ransom cheque, it's paying quickly for experts and continuity after an invoice error that looked routine.
Notifiable Data Breaches and Your Other Duties
The Notifiable Data Breaches scheme under the Privacy Act imposes a duty on APP entities. It isn't an insurance product and buying a policy doesn't transfer the decision to the insurer.
An eligible data breach is likely where there's unauthorised access to, disclosure of, or loss of personal information that's likely to result in serious harm, and remedial action hasn't prevented that risk. The entity should assess promptly, generally within 30 days, and where the breach is eligible notify the OAIC and affected individuals as soon as practicable.
Who holds information in a building business
A small builder can hold plenty of personal information without running an online store. Examples include homeowner contacts, identification documents, employee tax and superannuation details, subcontractor ABNs and bank details, tenant information and developer buyer records.
Some smaller businesses aren't automatically APP entities because of the small business threshold. Don't treat that as a complete answer. Contractual duties to a principal, state requirements, payment obligations and uses of employee information outside the employment exception can still require action.
Use a site analogy. Telling neighbours the gate was left open is separate from paying for what was taken. Notification is about warning people whose information may be misused. Insurance may fund legal advice, notice drafting and call handling if the wording grants those costs.
Cover can pay the cost of doing the right thing. It doesn't decide whether a notice is legally required, and it doesn't extend the statutory clock.
What to prepare before an incident
- Name the decision maker: Record who can engage lawyers and approve customer notices after hours.
- Map the records: Know where payroll, client identity documents and subcontractor payment data are stored.
- Keep contract clauses together: Principals may require faster notice than the general legal process allows.
- Preserve evidence: Don't delete suspicious mail or reset devices before investigators advise you.
Critical infrastructure obligations sit under a different regime, and most residential builders are outside it. Your practical task is simpler: identify personal information, know who assesses serious harm and make sure that person can reach the insurer's breach coach quickly. The controls below determine whether that call leads to a payable claim.
Controls That Keep a Cyber Claim Payable
Underwriters now ask for evidence, not just confident answers on a proposal form. The ASD's ACSC Annual Cyber Threat Report 2024-2025 publication recorded more than 1,200 cyber-security incidents in FY2024-25, an 11% year-on-year increase, and reported the OAIC received 595 data-breach notifications from July to December 2024, 15% more than in the preceding six-month period.
Evidence a builder can show
- Multi-factor authentication: Make it mandatory for email, remote access, payroll, banking and administrator accounts.
- Tested backups: Keep offline or immutable copies and record an actual restore test, not only a successful backup message.
- Endpoint protection and patching: Cover the laptops and tablets that open plans, payroll files and supplier attachments.
- Least-privilege access: Site supervisors shouldn't be able to change supplier bank details unless that task belongs to their role.
- Split payment duties: The person who creates or changes an invoice shouldn't be the final payment approver.
- Call-back verification: Phone a number already on file whenever bank details change, even for a regular subcontractor.
- One-page incident plan: Name who calls the insurer, bank and OAIC adviser, and list insurer-approved vendors.
Compromised credentials enable mailbox takeover. Mailbox takeover enables a redirected payment or data theft. Weak backups then stretch the outage and increase restoration and notification costs.
That chain explains why controls are linked. MFA blocks many credential attacks, segregation limits what a compromised user can approve, and a call-back catches a convincing message before money leaves. Backups don't stop fraud, but they shorten recovery if files are encrypted or deleted.
Minimum-security conditions can restrict indemnity when the business didn't maintain a control stated in its proposal. Don't write that MFA applies to every account if the shared estimating login is exempt. Fix the exception or disclose it.
If you're organising evidence for a quote, Freeform Company's cyber risk assessment guide can help you structure systems, access and recovery gaps before a broker approaches insurers. Bring screenshots of MFA settings, the latest restore test date and your written bank-change procedure. Those items let an underwriter price the actual risk rather than assume the worst.
What Drives Premiums Limits and Excesses
Two building firms with the same headcount can receive very different cyber terms. Underwriters price exposure plus controls, not staff numbers alone.
Revenue band and trade type set the starting point. The quote then moves with the volume and sensitivity of personal information held, remote access, email security, MFA coverage, backup testing, prior incidents and how supplier payments are approved. For construction, heavy invoice traffic and subcontractor impersonation often count for more than owning a server. Tested backups and a written call-back for bank changes can improve fraud terms. Shared logins and one person approving payments can narrow the market.
A prior incident does not end the discussion. The underwriter will ask what changed since.
A small specialist market
Cyber remains a specialist line with low uptake among smaller businesses and a small share of total premium. The ACSC factsheet for businesses and organisations on the 2024-25 threat report describes the threat background that sits behind that market.
Do not assume a business pack already includes it. Ask for the cyber grant and any sub-limit in writing.
Reading limits in layers
Separate the aggregate limit from smaller buckets inside it. Incident response may carry one sub-limit. Social engineering and funds-transfer fraud often carry a lower one. Dependent business interruption can carry another.
Check those layers against one redirected progress claim plus expert costs. Investigation and notification can use up a small aggregate before a client claim arrives. The excess for fraud is often higher than the excess for forensic costs. Minimum-security conditions also matter. A missed MFA promise can affect payment more than a small premium saving.
Ask three questions on every quote.
- What's the fraud sub-limit: Does it cover both social engineering and direct funds-transfer fraud?
- What excess applies: Is there a separate fraud excess or waiting period?
- What happens after a control failure: Does the wording restrict indemnity if a stated safeguard was not operating?
How to Buy Cover and Notify a Claim
Buying cover
- List real exposures: Note emailed invoices, progress claims, payroll, client contacts, annual revenue and who can change bank details.
- Mark current policies: Identify whether social engineering, system failure and privacy liability are granted, sublimited or excluded.
- Gather control evidence: Bring MFA coverage, backup test results and the payment verification procedure so the proposal matches practice.
- Compare mechanics, not premium alone: Check aggregate limit, fraud sub-limit, excess, retroactive date, waiting period, territory, dependent systems and panel vendors.
- Bind carefully: Diary the notification clause and store the hotline number where accounts and management can find it after hours.
Notifying a claim
- Stop further payments: Call the bank the same day to attempt a recall and freeze related transfers.
- Notify the insurer immediately: Use the policy hotline within the required time and don't hire your own forensic firm if a panel is mandatory.
- Preserve evidence: Keep the mailbox, headers, devices and logs intact until investigators image what they need.
- Record the sequence: Write down times, amounts, approvers and the number used for any call-back.
- Get breach advice before writing to clients: Ask the breach coach whether OAIC or individual notice is required.
- Log every cost: Track interruption and extra expense inside the indemnity period.
Don't pay a ransom or admit liability before insurer consent where the wording requires it. The wider claims process principles in guidance on the General Insurance Code of Practice for small business claims are useful background, but your cyber notification clause sets the immediate deadline.
Arrange Cyber Cover With a Licensed Broker
A progress claim that gets diverted to a scammer account shows the gap fast. A standard business package will often exclude a payment you authorised, even when deception caused it. A cyber wording with a tested social engineering extension can respond, provided call-back verification, MFA and backup discipline are in place.
ABS Insurance Brokers Pty Ltd is Australian owned, holds Australian Financial Services Licence No. 700333 and arranges specialist cover for builders, contractors, trades and developers. We work through four steps: Tell Us What You Need, Risk Assessment, Compare Cover Options and Arrange Your Cover.
Call 1300 871 318 before your next progress-claim run. Bring your revenue band, current policies, MFA status, last backup test and a short description of how bank details are changed. Our office is at 2 Hartzell Place, Bankstown NSW 2200. Don't send card numbers or other sensitive data by unsecured email.
If a redirected subcontractor payment, locked job files or a privacy notice would disrupt your next project, let ABS Insurance Brokers Pty Ltd compare cyber wordings against the way your business sends invoices and approves payments. Call 1300 871 318 to start the four-step placement process and arrange cover that addresses incident response, cybercrime extensions and interruption in plain terms.
