Quick answer
Brisbane businesses are not targeted because of where they are. They are targeted because of what they do. Construction, property, and professional services firms move large payments between many parties by email, and that is exactly what Business Email Compromise (BEC) exploits. It is Australia’s costliest cybercrime. Nationally, a cybercrime is reported every six minutes and the average cost to a business is now A$80,850, up 50% year on year (ASD Annual Cyber Threat Report 2024-25). The fix is not expensive: multi-factor authentication, phone verification of any changed bank details, tested offline backups, and staff training stop the large majority of incidents.
This guide sets out the threats Brisbane businesses face today, which local industries carry the most exposure, and eight practical, low-cost steps to reduce risk. It is written for business owners and managers, not IT specialists.
Key statistics: cyber security in Australia, 2024-25
| Metric | Figure | Source |
| Frequency of reported cybercrime | One every 6 minutes | ASD Annual Cyber Threat Report 2024-25 |
| Average self-reported cost per incident | A$80,850 (up 50%) | ASD Annual Cyber Threat Report 2024-25 |
| Costliest cybercrime type | Business Email Compromise | ASD Annual Cyber Threat Report 2024-25 |
| Ransomware share of incidents | ~11% | ASD Annual Cyber Threat Report 2024-25 |
| Ransomware victims with data published online | 35% | ASD Annual Cyber Threat Report 2024-25 |
| Ransomware incidents discovered by ASD, not the victim | 39% | ASD Annual Cyber Threat Report 2024-25 |
| Growth in healthcare ransomware attacks | Doubled year on year | ASD Annual Cyber Threat Report 2024-25 |
These are national figures. Brisbane-specific breach statistics are not separately published by the ASD, and this guide does not claim otherwise. The reasoning for local relevance is industry exposure, explained below, not a Brisbane-only data source.
Is Brisbane at higher risk of cyberattack?
No single Australian city is targeted more than another. Most cyberattacks are automated and opportunistic: criminals scan the entire internet for weak points and do not check postcodes first. What raises Brisbane’s exposure is its industry mix. Brisbane’s economy runs on construction, property, professional services, government contracting, and resources, all sectors built around large payments moving between multiple parties by email. That structure is precisely what Business Email Compromise is designed to exploit, which is why local relevance comes from industry risk, not geography.
What is Business Email Compromise (BEC)?
Business Email Compromise is a cybercrime in which an attacker gains access to, or convincingly impersonates, an email account somewhere in a payment chain, then uses that access to redirect a legitimate payment to a bank account they control. It is currently the costliest form of cybercrime reported to the Australian Signals Directorate.
How a typical BEC attack works
- A criminal compromises or spoofs an email account belonging to a supplier, contractor, or executive.
- They monitor the inbox and wait for a genuine invoice, progress payment, or settlement to come due.
- They send a message, appearing to come from a trusted party, stating that bank details have changed.
- The victim pays the new account. The funds are typically unrecoverable once transferred.
A construction progress payment, a conveyancing settlement, a subcontractor’s invoice, and an architect’s fee are all textbook BEC targets: large, expected, and exchanged between parties who email each other routinely.
What’s the most common cyberattack in Australia?
Business Email Compromise is the costliest, but three attack types account for most local incidents:
- Business Email Compromise and payment redirection. No technical breach required, just a convincing message at the right moment.
- Ransomware. Attackers encrypt systems and steal data, then demand payment, often threatening to publish stolen data even if the victim restores from backup.
- Phishing and stolen or reused passwords. The most common way attackers gain their first foothold into a business.
Two of these three target people, not technology. That is why staff training and simple verification habits matter as much as any security software.
Which Brisbane industries carry the most cyber risk?
| Industry | Primary exposure | Why |
| Construction, infrastructure, trades | Payment redirection | Progress payments and subcontractor invoices; a single diverted transfer can cost hundreds of thousands of dollars |
| Professional services (law, conveyancing, accounting, engineering, architecture) | BEC, trust account fraud | Trust-account transfers and settlements are a favourite target; clients increasingly demand proof of security before engaging |
| Government suppliers and contractors | Supply-chain compromise | Brisbane hosts the Queensland Government; suppliers must meet security standards and are attractive as a route into larger systems |
| Health and life sciences | Ransomware, data theft | Hospitals, clinics, and research bodies hold highly sensitive data; national ransomware attacks on healthcare doubled in the past year |
| Resources and energy | Ransomware, IP theft | Brisbane-headquartered firms hold valuable commercial data and sometimes run critical infrastructure |
| Technology and startups | IP theft, data breach | Fast-growing firms hold valuable intellectual property and customer data, and often delay security investment |
Is cyber security now required to win government or corporate contracts in Queensland?
Increasingly, yes. Government departments and large corporates now routinely ask suppliers to demonstrate their security posture before awarding work. Typical questions in a tender or vendor assessment include whether the supplier uses multi-factor authentication, whether it is aligned to the Essential Eight, whether it holds ISO 27001 certification, and how it protects the data it handles.
For a Brisbane business supplying the Queensland Government or a large corporate client, a weak or missing answer to these questions can lose the work regardless of how strong the rest of the bid is. The Essential Eight is Australia’s baseline security framework and the one buyers ask about most often, making it the most practical starting point for compliance.
8 practical steps to protect a Brisbane business (in order of impact)
- Turn on multi-factor authentication (MFA) everywhere. Blocks the large majority of password-based attacks. Start with email and banking.
- Verify every change to payment details by phone. Use a number you already have on file, never one supplied in the email requesting the change. This single habit stops most BEC losses.
- Back up data offline, and test the restore. Tested, offline backups are the strongest defence against ransomware.
- Apply software and system updates promptly. Unpatched systems remain one of the easiest ways in for attackers.
- Train staff to spot phishing and payment scams. Teach your team to pause and verify anything unexpected involving money.
- Limit who can approve payments and access systems. Fewer people with access, and a second approver on large transfers, reduces the chance of a costly error.
- Have a written incident response plan. Know who does what before an incident happens. Fast isolation and clear reporting obligations materially change the outcome.
- Test defences and bring in expert help where it counts. Penetration testing finds gaps before criminals do. Round-the-clock monitoring means a breach is caught in hours, not months.
When should a Brisbane business bring in a cyber security partner?
Professional support is worth considering if any of the following apply:
- You handle sensitive customer, patient, or financial data and are not confident it is properly protected.
- You are being asked to prove your security posture to win government or large-corporate work.
- You regularly transfer large sums with no formal process for verifying payment changes.
- You need to meet a compliance obligation, such as the Essential Eight or ISO 27001, and do not know where to start.
- You have had a near-miss, a scam attempt, or an actual incident, and realised you were not ready.
- You are growing quickly and security has been an afterthought.
There is real value in working with a Queensland-based team that understands local business, can meet in person when it matters, and speaks plainly rather than in jargon.
How Cyber Ethos supports Brisbane businesses
Cyber Ethos is a Queensland-based cyber security advisory firm led by Dr Kiran Kewalramani, a PhD-qualified specialist holding CISSP, CISA, and GAICD credentials, with over 20 years of experience. Cyber Ethos helps businesses across Brisbane and South East Queensland protect what they have built, explained in language every board and management team can understand.
Services include penetration testing, 24/7 managed security monitoring, incident response and ransomware recovery, Essential Eight uplift, ISO 27001 support, and vCISO and cyber advisory, providing senior security leadership without the cost of a full-time executive hire.
Whether you run a construction firm, a law or accounting practice, a health provider, or a growing tech company, Cyber Ethos helps you get the fundamentals right and stay protected as you grow.
Ready to protect your Brisbane business? Book a consultation with Cyber Ethos, or call 1800 CETHOS (1800 238 467).
How do I report a cyber incident in Australia?
Report a cyber incident to the national authorities through Report Cyber, or get urgent help from the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), available 24/7. Depending on your industry and the nature of the incident, you may also have obligations to notify the OAIC or other regulators.
Frequently asked questions
Do Brisbane businesses really get targeted by cybercriminals?
Yes. Most cyberattacks are opportunistic and automated, scanning the entire internet for weaknesses regardless of location. Criminals do not check a postcode before targeting a business. With a cybercrime reported in Australia roughly every six minutes and the average business cost now around A$80,850, being based in Brisbane offers no inherent protection. Preparation does.
What’s the most common cyberattack on Brisbane businesses?
Business Email Compromise, where a criminal impersonates a supplier or executive and tricks someone into paying money to the wrong account or changing bank details. It is the costliest cybercrime in Australia, and it hits Brisbane’s core industries (construction, property, and professional services) hardest, because they move large payments between many parties by email.
How much does cyber security cost for a small business in Brisbane?
Far less than most people expect, and far less than the average incident cost of A$80,850. The most effective protections, multi-factor authentication, phone verification of payment changes, offline backups, staff awareness, and prompt software updates, cost little more than the time to set them up properly. Beyond the basics, services such as managed monitoring or an Essential Eight uplift are scaled to the size and budget of the business.
What’s the single most important thing a business should do first?
Turn on multi-factor authentication everywhere possible, starting with email and banking. It is free or low-cost, quick to set up, and blocks the large majority of password-based attacks, making it the highest-impact first step almost any business can take.
Do I need cyber security certification to win government or corporate contracts in Queensland?
Increasingly, yes. Tenders now commonly require suppliers to prove their security posture, through security questionnaires or an expectation to meet frameworks such as the Essential Eight or ISO 27001. Businesses that can demonstrate strong security are better placed to win work. Those that cannot are often filtered out early in the process.
What is the Essential Eight and does my Brisbane business need it?
The Essential Eight is the Australian Cyber Security Centre’s baseline set of eight mitigation strategies, including MFA, patching, and restricting admin privileges, designed to make it significantly harder for cybercriminals to compromise a system. It is the framework most frequently referenced in Queensland Government and large-corporate tender requirements, making it the standard starting point for Brisbane businesses seeking to demonstrate security maturity.
How is ransomware different from Business Email Compromise?
Ransomware encrypts a business’s systems and often steals data before demanding payment, sometimes threatening to publish that data even if the business restores from its own backups. Business Email Compromise does not touch systems at all. It relies purely on impersonation and deception to redirect a legitimate payment. Both are among the top three attack types affecting Brisbane businesses, but they require different defences: backups and patching for ransomware, phone verification and staff training for BEC.
Does Cyber Ethos provide cyber security services in Brisbane?
Yes. Cyber Ethos is a Queensland-based cyber security firm supporting businesses across Brisbane and South East Queensland with penetration testing, managed security monitoring, incident response, Essential Eight and ISO 27001 compliance support, and virtual CISO services. Call 1800 CETHOS (1800 238 467) to arrange a consultation.
Sources
- Australian Signals Directorate, Annual Cyber Threat Report 2024-25
- Cyber Ethos: Ransomware Attack Protection Guide
- Cyber Ethos: Essential Eight Framework Guide
- ISO/IEC 27001 overview, Wikipedia
