Approximately one quarter of reported cyber security incidents affected critical infrastructure organisations, including essential services such as education, health, communications, electricity, water and transport. After the government sectors as the top reporting sectors, the professional, scientific and technical sector and the health care and social assistance sector reported the highest number of cyber security incidents during the 2020–21 financial year. The top ten reporting sectors accounted for approximately 77 per cent of all incidents for the 2020–21 financial year (see Figure 7). The ACSC is working closely with critical infrastructure organisations and industry partners to improve information sharing on the scale and scope of cyber security incidents affecting Australia (refer to the CTIS Platform section for more information). Figure 7: Cyber security incidents by the top ten reporting sectors for financial year 2020–21 19.5% Commonwealth government 15.2% State, territory and local government 9.7% Professional, scientific and technical services 7.3% Health care and social assistance 6.2% Education and training 5.6% Information media and telecommunications Financial and insurance services 4% Retail trade 4% Construction 3% Manufacturing 2.7% 0% 5% 10% 15% 20% Note: While Commonwealth, state, territory, and local government accounted for approximately one third (35 per cent) of incidents in the 2020–21 financial year, the high reporting frequency of government agencies is in part due to the obligation to report significant cyber security incidents to the ACSC, and may not necessarily reflect an increased susceptibility of these networks to cyber incidents, when compared with industry. Ransomware During the 2020–21 financial year, the ACSC received nearly 500 ransomware cybercrime reports via ReportCyber, which is an increase of nearly 15 per cent compared with the previous 2019–20 financial year. In the 2020–21 financial year, the ACSC also responded to nearly 160 cyber security incidents related to ransomware. The professional, scientific and technical services sector and the health sector reported the most ransomware-related cyber security incidents (see Figure 8). The top five reporting sectors for ransomware-related incidents accounted for approximately 50 per cent of all ransomware-related incidents reported to the ACSC during the 2020–21 financial year. 20