About this report The ACSC Annual Cyber Threat Report 2020–21 has been produced by the ACSC, with contributions from DIO, ACIC, AFP, ASIO, the Department of Home Affairs, and industry partners. The report covers the financial year from 1 July 2020 to 30 June 2021. This is the second unclassified annual cyber threat report since ASD became a statutory agency in July 2018. The report highlights the key cyber threats affecting Australian systems and networks, and uses strategic assessments, statistics, trends analysis, and case studies to describe the nature, scale, scope and impact of malicious cyber activity affecting Australian networks. It also provides advice to Australian individuals and organisations on what they can do to protect their networks from cyber threats. Information, sources and data The ACSC manages and accesses a number of unique data holdings to ensure tailored advice and assistance to Australian governments, organisations and the public. ACSC data used in this report has been extracted from live datasets of cybercrime reports and cyber security incidents reported to the ACSC. As such, the statistics and conclusions in this report are based on point-in-time analysis and assessment. Cybercrime and cyber security incidents reported to the ACSC may not reflect all cyber threats and trends in Australia’s cyber security environment. The ACSC encourages the reporting of cyber security incidents and cybercrimes to inform ACSC advice and assistance to vulnerable organisations, and enhance situational awareness of the national cyber threat environment. Glossary of key cyber terminology The ACSC glossary for terminology used in reports can be found on the website: https://www.cyber.gov.au/acsc/view-all-content/glossary Feedback The ACSC welcomes feedback to improve the reports and services it provides to Australians. Feedback can be provided by emailing asd.assist@defence.gov.au or via phone at 1300 CYBER1 (1300 292 371). 7