Compared to the previous financial year, the total number of cyber security incidents in the 2020–21 financial year decreased by 28 per cent and there were no Category 1 or Category 2 incidents in the 2020–21 financial year. However, a higher proportion of incidents in the 2020–21 financial year were categorised as Category 4 incidents – indicating that cyber security incidents reported this year had a more profound impact on victim organisations. This change is due in part to an increase in attacks by cybercriminals on larger organisations and the impact of these attacks on the victims. The attacks included data theft, extortion and/or rendering services offline. Category 4 incidents accounted for nearly half (49 per cent) of the reported cyber security incidents in the 2020–21 financial year (see Figure 6). This is a change from the previous financial year, where the highest proportion of cyber security incidents was at Category 5 (36 per cent), and Category 4 cyber security incidents accounted for only a third of total cyber security incidents (35 per cent). The highest proportion of incidents the ACSC responded to related to low-level malicious activity such as targeted reconnaissance, phishing, or non-sensitive data loss, accounting for more than half of the cyber security incidents. Figure 6: Cyber security incidents by incident category for financial year 2020–21 C4 Sustained disruption of essential systems and associated services C6 Exfiltration or deletion/damage of key sensitive data or intellectual property Malware, beaconing or other active network intrusion; temporary system/service disruption Low-level malicious attack — targeted reconnaissance, phishing, non-sensitive data loss C5 C5 C6 C5 58 C6 C6 Member(s) of the public C3 C6 8 C4 6 C6 C2 8 44 C3 300 229 C5 Small Organisation(s) Medium-sized Organisation(s) State Government Academia/R&D Sole Traders Schools Large Organisation(s) Supply Chain 51 C2 C3 C3 C4 90 C1 C2 C3 C4 12 C1 14 25 198 C1 C2 C3 C5 11 C2 107 18 204 83 16 Scanning or reconnaissance 22 C5 C6 2 C3 C4 75 5 C3 C4 13 C6 2 11 1 C4 7 C5 Federal Government / National Infrastructure Supply Chain to Critical National Infrastructure 10 2 C5 National security Aus essential service(s) Critical National Infrastructure Significant number impacted Note: In order to manage the range and volume of reported incidents, the ACSC uses a cyber incident categorisation system to triage and prioritise responses to mitigate each incident. The ACSC categorises incidents based on severity of impact and extent of compromise. This allows the ACSC to focus its resources more effectively, and ensures a consistent approach and an appropriate level of response measures to each incident. 19