Figure 8: Top five reporting sectors for ransomware-related cyber security incidents Professional, Scientific and Technical Services Health Care and Social Assistance Manufacturing Education and Training State, Territory and Local Government 0% 5% 10% 15% 20% Phishing campaigns, targeted spear phishing, remote access through vulnerable machines and the use of publicly available exploits remain the most common vectors for deploying ransomware. Personal information on professional and social networking platforms, including profiles, can provide malicious actors with useful information for targeting, including spear phishing or other socially engineered online approaches. Business Email Compromise (BEC) Australian businesses are losing significant amounts of money through BEC. BEC cybercrime was one of the top cybercrime categories, making up nearly 7 per cent of the cybercrime reports received in the 2020–21 financial year. While there has been a slight decrease in BEC reports compared with the previous financial year, self-reported financial losses have increased – total losses were approximately $81.45 million (AUD) for the 2020–21 financial year, an increase of nearly 15 per cent from the previous financial year. Average loss per successful BEC transaction also increased, by 54 per cent (see Figure 9) – in one case, BEC led to the bankruptcy of a company (see Case Study: Australian hedge fund subject to BEC and declared bankruptcy, page 45). Figure 9: Average reported losses per successful BEC cybercrime report made in financial year 2020–21 compared with financial year 2019–20 $60,000 $50,673 (AUD) $45,000 $32,935 (AUD) $30,000 $15,000 $0 Average reported loss FY 19-20 Average reported loss FY 20-21 Note: Figures rounded to the nearest dollar (AUD). 21