Nearly seven in ten Australian businesses have experienced a ransomware attack in the past five years, with 78 per cent of successfully breached organisations paying the ransom, up from 64 per cent in 2025.Management consultancy McGrathNicol’s latest ransomware survey, based on responses from 1,000 Australian business decision-makers, also found payments are happening faster, with four in ten victims paying within 24 hours and 41 per cent skipping negotiations altogether.
You’re out of free articles for this month
Overall, 84 per cent of respondents said their organisation would be willing to pay a ransom in at least some circumstances.
The findings come despite improvements in incident response and recovery capabilities. The proportion of businesses reporting a successful breach fell to 30 per cent, from 37 per cent in 2025. However, executive confidence in their organisation’s preparedness also declined, with only 88 per cent of leaders considering their organisation prepared to respond to a cyber attack, compared with 96 per cent last year.
“Our survey reveals a fundamental tension. Most Australian organisations have the plans, insurance, and governance frameworks expected of a mature cyber resilience program, but those that suffer a ransomware attack are now more likely to pay,” Darren Hopkins, partner and head of cyber at McGrathNicol, said in a statement.
“More attacked businesses chose to pay a cyber ransom in 2026 than in 2025, payments were made faster, and negotiation became less common than in previous years.”
Hopkins said organisations had made significant improvements in incident response and formal preparedness since 2021, but warned that having plans and insurance was not enough without regularly testing them through realistic simulations.
The research also highlighted the disproportionate exposure of smaller businesses, with organisations generating less than $50 million in revenue more than twice as likely to have experienced a successful breach as larger enterprises.
More than four in five business leaders believe SMEs are more vulnerable to ransomware than larger organisations, identifying a lack of dedicated cybersecurity personnel (37 per cent), limited technical expertise (35 per cent) and constrained security budgets (35 per cent) as key contributing factors.
“The most effective resilience measure for SMEs is establishing trusted external support before an incident occurs,” Brendan Payne, cyber partner at McGrathNicol, said.
“Organisations that know who to call, what information they need, and how they will recover will be better positioned to avoid rushed payment decisions.”
The most common reasons businesses would consider paying a ransom were restoring normal operations faster, regaining control of critical systems, and minimising harm to employees, customers, and suppliers.
The operational consequences of successful breaches were significant, with 65 per cent of affected businesses reporting severe or significant impacts on IT systems and 63 per cent reporting similar impacts on financial operations.
Phishing remained the most commonly experienced cyber threat over the past 12 months, affecting 44 per cent of businesses, followed by business email compromise at 33 per cent, malware at 32 per cent, and the exploitation of unpatched vulnerabilities trailing at 23 per cent.
The survey was conducted online by YouGov between 28 August and 14 September 2026, targeting business owners, partners, board members and C-suite executives at Australian organisations with at least 50 employees. Results were weighted by business size to reflect the Australian business landscape.
——————————————————–
Click Here For The Original Source.
