Australians filed a cybercrime report about every six minutes over the past year, and artificial intelligence is making the attacks behind those reports faster and more convincing. That is the main finding of the ASD Cyber Threat Report 2025-26. It is the seventh annual assessment from the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).

In FY2025-26, the agency received more than 82,000 cybercrime reports through ReportCyber. It responded to over 1,500 cyber security incidents, up more than 20% on the previous year and 36% over five years. It also notified Australian entities of potentially malicious activity more than 4,400 times, almost 80% more than in FY2024-25.

What the ASD Cyber Threat Report Says About AI

The report calls AI the defining force in the threat environment this year. In his foreword, Deputy Prime Minister and Defence Minister Richard Marles wrote that AI is helping malicious actors find vulnerabilities faster and exploit them at greater scale, speed and sophistication. He also noted that new threats have emerged in recent weeks from the unintended actions of AI agents and from model testing.

ASD’s ACSC makes one clear distinction. AI has not created new kinds of threats. It has amplified and sped up existing ones. AI-enabled cyber threats are most visible in social engineering. Attackers are using AI to write phishing emails with no spelling or grammar errors and to automate targeted spearphishing. The Australian Securities and Investments Commission has also seen a sharp rise in scams that use deepfake videos of celebrities and politicians.

The time defenders have to respond is also shrinking. The agency has previously observed that most vulnerabilities are exploited within two weeks, and some within 48 hours of a patch being released. It expects AI-driven tools to shorten that window further over the next 12 months. Publicly reported vulnerabilities (CVEs) rose 30%. Old flaws are still a problem too: ASD’s ACSC recorded the successful exploitation of a vulnerability first identified in 2008.

Incident Severity Grows in ASD Cyber Threat Report Data

Only one Category 2 incident was recorded this year. However, extensive compromises rose from 26 to 40. ASD’s ACSC identified 362 incidents after proactively notifying organisations. A single notification about cPanel vulnerabilities, sent to 340 entities in May 2026, led to more than 60 confirmed incidents.

The number of ransomware incidents held steady at 139, but extensive ransomware incidents rose from 16 to 24. Health Care, Professional, Scientific and Technical Services, and Manufacturing remained the most affected sectors. Data breaches made up 98 incidents, a 66% increase on the previous year. Separately, the Office of the Australian Information Commissioner received 1,205 breach notifications in 2025. That is the highest yearly total since its Notifiable Data Breaches scheme began in 2018.

The financial impact is rising for businesses. The average self-reported cost of cybercrime per business report rose 16% to $93,500. For medium-sized businesses, it rose 45% to $141,300. The average cost for individuals stayed at $33,000. Identity fraud remained the most reported cybercrime, although reports fell 18%.

Stolen access is now a major entry point. Compromised accounts and credentials were among the most frequently reported incident categories, and phishing appeared in 39% of incidents. Government survey research cited in the report found that 55% of Australians reuse passwords across multiple accounts.

State Actors and Critical Infrastructure in the ASD Cyber Threat Report

State-sponsored actors continued to target Australian government, business and individuals to gain sensitive information. The report says these actors are increasingly pre-positioning inside networks to enable future disruption. Marles wrote that the line separating state-sponsored espionage from sabotage and cybercrime is becoming increasingly blurred.

In April 2026, ASD’s ACSC and international partners highlighted a shift by China-nexus actors. These actors are moving towards large covert networks built from compromised home and small office routers, Internet of Things devices and smart devices.

Critical infrastructure accounted for 154 incidents, or 10% of the total, a decrease of almost 7%. Phishing was the leading initial access technique at 36%, and Financial and Insurance Services was the most affected critical infrastructure division at 30%.

What the Threat Report Asks Organisations to Do

In October 2026, ASD’s ACSC released the Essentials series. It evolves the Essential Eight into a principles-based framework with three chapters: Enterprise IT, Operational Technology and Cloud.

Under its Cyber Action Year, the agency is pushing five priorities:

• Replacing or mitigating legacy technology.
• Implementing best-practice event logging.
• Managing supply chain risk.
• Preparing for AI-enabled threats.
• Preparing for post-quantum cryptography, including ceasing the use of traditional asymmetric cryptography by the end of 2030 or sooner.

The report also urges organisations to patch faster. For individuals, it recommends reviewing privacy settings and enabling multi-factor authentication or passkeys.

Suspicious activity, incidents and vulnerabilities can be reported at cyber.gov.au or through the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).

Supermarket freezers that cooked their own stock overnight. Text messages about traffic fines that quietly steal payment PINs. North Korean IT workers paying Americans to keep remote jobs at U.S. companies. This weekly cybersecurity roundup brings together incidents that reached well beyond stolen data, causing spoiled food, store fires, disrupted grocery deliveries and drained bank accounts. Here are the stories that shaped the week.

Hackers Turned French Supermarket Freezers Into Ovens Overnight

Hundreds of French supermarkets woke up to spoiled stock after hackers took remote control of internet-connected refrigeration systems overnight. Retailers confirmed on Monday that attackers pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F) while stores were closed. Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, keeping units heating instead of cooling. The attack did not use a new exploit. It targeted ageing connected devices still online years after their manufacturer stopped supporting them. E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were all hit. At least 300 Intermarché and Netto stores were affected, Coopérative U reported more than 100, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, noted that estimates sit around 400 stores, with some branches reporting losses of about €250,000. Some reports put the total above 500 shops. Read More

Fake Traffic Challan Texts Are Stealing UPI PINs From Android Users in India

GhostBat RAT, an Android malware strain first identified by Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI, wallet and fintech apps. It spreads through SMS messages about unpaid traffic challans that lead victims to fake mParivahan download pages, with GitHub repositories also used to host the malicious files. Cyble's research also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution. Many of the fake apps are first-stage loaders that hide the real payload in encrypted files or download it later, helping them pass initial scans. Read More

Death Threats, Laptop Farms, Stolen IDs: Inside North Korea's Job Scam

North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, according to an updated FBI public service announcement. The Justice Department also announced charges, two arrests and the seizure of about 187 computer devices linked to the scheme. The FBI said Americans are being hired to appear on camera, sit for job interviews, verify fake identities, lend social media or professional networking accounts, ship packages, complete drug tests or fingerprint submissions, and keep work laptops running from their homes. The workers also use stolen identities, extort victims and threaten physical violence. North Korea's government receives an estimated 85 to 90 percent of the revenue they generate, which helps fund its nuclear weapons and military programs. Read More

Ahold Delhaize Incident Disrupts Grocery Supply in Netherlands and Belgium

A cyber incident at Ahold Delhaize has disrupted parts of the grocery retailer's IT infrastructure, prompting it to take some systems offline. Stores remain open, but reports from the Netherlands and Belgium indicate disruption to distribution, customer service and some delivery operations. The company has not disclosed the nature of the incident or whether customer or employee data was affected, and it has given no timeline for full recovery. Ahold Delhaize operates in nine countries, employs more than 384,000 people and owns U.S. brands including Food Lion and Stop & Shop. Read More

Kerala Police Signs MoU With Cyble for Cybercrime Investigations

Kerala Police has signed a three-year Memorandum of Understanding with Cyble to bring threat intelligence into cybercrime investigations. The agreement, signed through Cyble Infosec India Private Limited and announced on October 12, 2026, covers intelligence support, investigative assistance and capacity building. It will support the Kerala Police Cyber Operations wing and Cyberdome in identifying and investigating emerging threats. Read More [caption id="attachment_114716" align="aligncenter" width="600"] Image Source: Cyble[/caption]

Seoul National University Reports 28 Hacking Incidents Since 2021

Seoul National University has suffered 28 hacking incidents since 2021, exposing more than 1,100 pieces of personal information belonging to students, faculty and staff. The figures come from data the university submitted to Rep. Baek Seung-ah of the Democratic Party. There were eight attacks in 2021, a peak of 10 in 2022, none in 2023, one in 2024 and five in 2025, with four confirmed so far this year. Departmental systems were hit most often, in 19 incidents, followed by laboratory systems with six, research systems with two and one institutionwide system. Read More

Morocco Prioritizes AI Threats and Critical Infrastructure Defense

Morocco is placing greater focus on proactive threat detection, critical infrastructure protection and artificial intelligence in its cybersecurity strategy. Speaking at the opening of National Cybersecurity Week in Rabat, Abdellatif Loudiyi, Minister Delegate in charge of National Defense Administration, said cybersecurity must be built into institutional governance rather than treated as an extra expense. He called for stronger preparedness, early detection and coordinated incident response. The event runs from October 12 to 14. Taken together, this week's incidents show attackers targeting the systems people rely on every day, from shop refrigeration and grocery supply chains to payment apps and hiring processes. Follow The Cyber Express for next week's weekly cybersecurity roundup and ongoing coverage of these stories. Read More

Japan is stepping up its plans to find cyber attackers who may already be inside the networks that keep essential services running. Under a new fiscal 2027 initiative, the government plans to work with private companies to strengthen Japan threat hunting across critical infrastructure, including power utilities and telecommunications operators. The focus is not only on stopping attacks after they are detected, but on finding signs that an attacker has gained access and is quietly moving through a system without triggering an alert. The government will develop ways to detect these threats and share the methods with private-sector operators, while the Defense Ministry will be able to provide personnel to assist companies when requested.

Japan Threat Hunting to Target Hidden Cyber Threats

The initiative forms part of Japan’s broader active cyber defense efforts. Threat hunting involves actively searching systems for signs of malicious activity rather than waiting for an alert or confirmed attack. Japan’s National Cybersecurity Office plans to use information about potential threats to recreate attack scenarios in a virtual environment. The office will then develop and test detection methods that can be used by private-sector companies. The aim is to help critical infrastructure operators identify attackers that may have already entered their systems and remained undetected. Detecting such activity could also help reduce the risk of a cyberattack disrupting essential services during an emergency. Legislation related to active cyber defense took effect on Thursday, giving the government a framework for expanding these cybersecurity measures.

Defense Ministry to Assist Critical Infrastructure Operators

Japan’s Defense Ministry is also preparing to provide direct support to operators of critical infrastructure. Companies will be able to request assistance, after which the ministry could dispatch personnel with threat-hunting experience developed through the information systems of Japan’s Self-Defense Forces. The National Cybersecurity Office and Defense Ministry have included the related costs in their fiscal 2027 budget requests. Threat hunting can require considerable resources because security teams need to collect and examine large amounts of system event logs. The purpose is to identify unusual activity that may otherwise go unnoticed. NTT Data Japan has been carrying out proactive threat hunting on its own systems since 2024. The company checks system logs for suspicious activity even when there has been no security alert. A representative of the National Cybersecurity Office also said threat-hunting methods could help address ransomware. Such attacks can involve attackers exploring a victim’s systems after gaining initial access, meaning suspicious activity may exist before the ransomware itself is deployed.

Recent Cyberattacks Add to Japan’s Concerns

Japan’s planned expansion of threat hunting comes as cyber incidents have affected government networks and companies across different sectors. In September 2026, the government disclosed that its common infrastructure network had been targeted in a cyberattack that began in May. Digital Minister Hisashi Matsumoto said about 246,000 personal records could have been leaked. The affected Government Solution Service, or GSS, is used by government agencies and independent administrative agencies. The potentially exposed information included about 189,000 employee records and around 57,000 records belonging to businesses and individuals involved in agency operations. An analysis found that a third party had compromised the system by exploiting a bypass involving a virtual private network, or VPN. Other recent incidents have affected private-sector operations. The Nichirei cyberattack in July disrupted food deliveries after the frozen food and logistics company confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan. Nihon Kotsu also recently reported a malware-related incident that disrupted taxi dispatch services after parts of its IT infrastructure were taken offline. Earlier incidents involving Aflac Japan, KDDI, Sapporo Holdings and Nidec showed that attackers could gain access through subsidiaries, overseas operations or third-party infrastructure. Japan’s fiscal 2027 plans therefore put greater emphasis on looking for attackers that may already be inside a network, rather than relying only on alerts after suspicious activity has become visible.

Artificial intelligence systems are becoming more capable and autonomous, raising new questions about how they can be monitored, controlled and secured. Speaking before the United Nations Security Council, OpenAI CEO Sam Altman warned that the rapid pace of AI development could create significant AI security risks, particularly if systems advance faster than institutions can respond. Altman highlighted concerns ranging from human control and autonomous AI to emerging vulnerabilities, concentrated technological power and the need for international incident reporting. He also called for stronger cooperation between governments, critical infrastructure operators and technical experts to address emerging AI threats.

Here are six key AI security risks highlighted in his remarks.

1. Losing Human Control Over Advanced AI

One of Altman’s central concerns was the possibility that humans could lose control over increasingly capable AI systems. He warned that AI could move so quickly that people may no longer be able to understand what systems are doing or intervene when necessary. He argued that developers should not train systems unless they can make a strong case that those systems can remain under human control. The concern becomes more significant as AI systems become capable of handling increasingly complex tasks and making decisions with less direct human involvement.

2. AI Systems Becoming More Autonomous

The growing autonomy of AI systems presents another challenge for AI cybersecurity. Altman pointed to the possibility of AI systems improving themselves and future versions of themselves, describing this as recursive self-improvement. As the process of developing AI becomes more automated, the pace of progress could accelerate. For security teams and policymakers, increasingly autonomous systems could make monitoring, testing and intervention more difficult.

3. Emerging Vulnerabilities and New Threats

More capable AI systems could also introduce vulnerabilities and threats that organizations and governments may not yet fully understand. Altman called for secure channels between governments, critical infrastructure operators and technical experts to share information about emerging vulnerabilities and threats. The remarks place information sharing at the center of preparing for AI vulnerabilities, particularly as AI becomes increasingly integrated into important systems and infrastructure.

4. AI Power Concentrating in Too Few Hands

Altman also warned about the concentration of advanced AI capabilities among a small number of companies, individuals or countries. He argued that no single company or country should be able to use the most powerful AI systems to impose its worldview on others. From a security perspective, concentrated control over highly capable AI could create systemic risks if a limited number of actors have disproportionate access to powerful technology.

5. The Need for Global AI Incident Reporting and Threat Sharing

Altman called for accurate and speedy AI incident reporting, including classification and reporting protocols that would allow countries to learn from failures before they become larger problems. He also called for common standards covering AI capabilities, risk assessments, safeguards and human oversight. Such standards, he said, could help countries compare evidence and establish a shared understanding of what effective safeguards and oversight should look like.

6. AI Development Could Outpace Existing Safety Measures

The speed of AI development itself could become a security challenge. Altman warned that rapid progress could move faster than institutions are prepared to handle. He argued that competition between companies should not become a reason to accept excessive technological risk. He also stressed the importance of alignment, monitoring and safety guarantees as AI systems become more capable. For AI safety, this means ensuring that security measures and oversight develop alongside increasingly powerful systems rather than being added only after problems emerge.

AI Security Moves Into a Global Conversation

Altman’s remarks put AI security risks alongside broader questions about international cooperation, human oversight and technological governance. His proposed approach includes global standards for measuring AI capabilities and risks, incident reporting mechanisms, and secure communication between governments, critical infrastructure operators and technical experts. As AI systems become more autonomous and capable, the challenge will not only be what these systems can do, but whether organizations and governments can monitor, understand and respond to the risks they create.

European Commission President Ursula von der Leyen has proposed an Emergency Security Protocol that would allow any European Union member state to trigger a coordinated response to security incidents including cyberattacks, sabotage and drone incursions. The proposal was announced during von der Leyen’s 2026 State of the Union address in Strasbourg, where she called for a new European security strategy in response to what she described as rising threats across the bloc. Recent incidents in Denmark, Lithuania and Poland, along with an attempted drone attack in Leipzig, were cited as examples of the changing security environment.

Emergency Security Protocol Would Bring EU Governments Together

Under the proposed Emergency Security Protocol, a single member state could trigger the mechanism, prompting all 27 EU governments to convene. The proposed framework would be designed to coordinate a European response, deter further escalation and mitigate the consequences of an incident. Von der Leyen presented the mechanism as a European counterpart to NATO’s Article 4, which allows alliance members to consult when the territorial integrity, political independence or security of a member is threatened. The EU proposal, however, was presented as a mechanism for incidents that fall below the threshold of armed aggression but still pose a national security threat. The proposal does not yet specify what decisions would follow such a meeting or whether the mechanism would create predetermined responses to specific types of incidents.

Cyberattacks and Hybrid Threats Drive Security Push

The Emergency Security Protocol comes as the EU considers how to respond to a broader range of hybrid threats. Von der Leyen cited cyberattacks, sabotage, arson and drone incursions as threats that are increasing across Europe. She argued that existing EU institutions and decision-making processes have not kept pace with the changing security environment. As part of the proposed European security strategy, she called for a European counter-hybrid playbook and greater agreement on how member states should respond to incidents that threaten national security without amounting to conventional armed aggression. The EU already has mutual-assistance and solidarity provisions. Article 42(7) of the Treaty on European Union provides for mutual assistance when a member state is the victim of armed aggression, while Article 222 of the Treaty on the Functioning of the European Union contains a separate solidarity provision.

EU Security Council Also Proposed

Alongside the Emergency Security Protocol, von der Leyen proposed creating a European Security Council focused on the security of the continent. The proposed format would include EU leaders and partners such as Canada, Norway, Ukraine and the United Kingdom. The initiative is intended to provide a broader forum for discussions on European security as the bloc reassesses how it responds to emerging threats. The Commission is also expected to outline further details through its forthcoming European security strategy.

Decision-Making Questions Remain

The proposed mechanism comes as questions remain over how quickly the EU can reach collective decisions during security crises. Many decisions under the bloc’s common foreign and security policy require unanimity, meaning individual governments can block measures supported by other member states. EU sanctions are also adopted unanimously. Von der Leyen did not specify whether the proposed protocol would change those decision-making rules, establish agreed responses in advance or primarily provide a framework for consultation. She also announced a European Instrument for Strategic Enablers, covering capabilities including air and missile defence, strategic transport, air-to-air refuelling, space systems and cyber capabilities. The initiative is intended to be aligned with NATO. The Emergency Security Protocol, European security strategy and proposed European Security Council form part of a wider effort outlined in the 2026 State of the Union address to strengthen coordination around Europe’s changing security environment. Further details are expected as the Commission develops its proposed security strategy.