The cost of a hacked website is usually far more than the clean-up bill. ASD puts the average cost of a cybercrime report from an Australian small business at $56,600. For a website hack, the money goes on repairs, lost sales while the site is down or flagged, email problems, possible data breach obligations and a lot of your own time. Prevention costs a small fraction of that.
Key takeaways
- ASD’s average cost per small business cybercrime report was $56,600 in 2024–25, up 14%.
- The clean-up is often the smallest cost. Downtime, Google warnings and lost trust cost more.
- A hacked site can also hit your email, your search rankings and your obligations under the Privacy Act.
- The median small business spends $500 a year on cyber security, according to auDA’s research.
How much does a cyber attack cost an Australian small business?
The best Australian figure comes from the Australian Signals Directorate. In 2024–25, the average self-reported cost of cybercrime was $56,600 per report for small businesses, up 14% on the year before. Medium businesses averaged $97,200 (ASD Annual Cyber Threat Report).
It isn’t rare, either. The ABS found that 21% of Australian businesses had a cyber security incident in 2024–25 (ABS). Those figures cover all cybercrime, not only websites, and an average hides a wide range. A simple website infection caught early costs far less. One that steals customer data or hijacks your email can cost much more.
What makes up the cost of a hacked website?
1. Cleaning and repairing the site
This is the bill most owners expect. A proper clean-up removes the malware, the backdoors and any fake admin users, then closes the hole the attacker used. Sucuri found backdoors on 49% of compromised sites (Sucuri), which is why a cheap, quick clean often leads to a second bill.
2. Lost sales while the site is down or flagged
Some hacks take the site offline. Others leave it running but redirect visitors to scam pages. Your host may also suspend it to protect other customers. Work out your own figure: if the site brings in $2,000 of orders a week and is offline for five days, that’s about $1,400 in sales gone.
3. Google warnings and lost rankings
Google Safe Browsing protects over five billion devices every day (Google Safe Browsing). If your site is flagged, many visitors see a red warning instead of your home page. After a clean-up, Google says a malware review can take from a few days to a few weeks (Google Search Console Help). Spam pages injected by attackers can also drag down your rankings for months.
4. Email blocked or hijacked
A hacked site often sends spam, which can get your domain or server blocklisted, so your quotes and invoices land in junk. Worse, stolen logins can be used to send fake invoices from your real address. Australians lost $166.8 million to payment redirection scams in 2025 (ACCC).
5. Customer data and breach obligations
If the site holds customer details, a hack may be a data breach. Businesses covered by the Notifiable Data Breaches scheme must assess a suspected breach within 30 days, and notify serious ones as soon as practicable (OAIC). Even if you’re not covered, customers notice. Our guide to the Privacy Act for small business websites explains who the rules apply to.
6. Your time, and your staff’s
Owners routinely lose days to a hack: talking to the host, the developer and the bank, answering worried customers and resetting passwords. That time comes straight out of running the business.
Why do so many small businesses underestimate the risk?
Many owners assume they’re too small to be worth attacking. auDA’s 2026 research found 38% of small businesses think they’re too small to be targeted, and the median small business spends $500 a year on cyber security (auDA Digital Lives of Australians 2026).
Most website attacks are automated, though. Bots look for known weak plugins and guessable passwords, without caring whose site it is. Wordfence blocked more than 55 billion password attacks on WordPress sites in 2024 alone (Wordfence). Pirated software is a common shortcut in. Our article on nulled plugins explains why a “free” premium plugin can end up the most expensive thing on your site.
How do you estimate your own cost of a hack?
Use this quick sum with your own numbers:
| Cost line | How to estimate it |
|---|---|
| Lost sales | Weekly online sales or enquiry value, times one to two weeks |
| Clean-up and repair | A professional clean-up quote, plus any rebuild if backups are missing |
| Your time | Days spent dealing with it, times what a day of your time is worth |
| Email and payments | Any money lost to fake invoices, plus time spent fixing email delivery |
| Customers | Refunds, goodwill gestures and lost repeat business |
For many businesses, the total runs well into the thousands, even for a “minor” hack. Our broader guide to small business cyber security in Australia covers the risks beyond the website.
What does prevention cost by comparison?
Much less. The basics are updates, off-site backups, malware scanning, a firewall and someone watching. Our website security monitoring covers scanning, blacklist monitoring and firewall protection. Our website maintenance plans start at $40 a month + GST and include hack-free or we fix it free. Pair them with secure web hosting in Australian data centres, and most of the costs above never arrive.
Frequently asked questions
How much does it cost to fix a hacked website?
It depends on how deep the infection goes, whether good backups exist and how many sites share the account. A simple clean-up is the cheapest part. The bigger costs usually come from lost sales, Google warnings, email problems and the time you spend dealing with it.
What is the average cost of a cyber attack for a small business in Australia?
ASD reported an average self-reported cost of $56,600 per cybercrime report from small businesses in 2024–25, up 14% on the year before. That covers all cybercrime, including email fraud, not only hacked websites.
Does business insurance cover a hacked website?
Standard business insurance often doesn’t. Cyber insurance may cover clean-up, lost income and breach response, but policies vary and many expect basic security like updates, backups and multi-factor login. Check your policy wording with your broker.
Can a hacked website affect my Google rankings?
Yes. Google may show a warning to visitors, and spam pages added by attackers can push your real pages down. Rankings usually recover after a full clean-up and a review request, but it can take weeks.
Do I have to tell customers if my website is hacked?
If your business is covered by the Notifiable Data Breaches scheme and the hack is likely to cause serious harm, you must notify affected people and the OAIC. Even if you’re not covered, telling customers honestly protects trust.
Sources
- Annual Cyber Threat Report 2024–2025, Australian Signals Directorate, October 2025
- Characteristics of Australian Business, 2024–25, Australian Bureau of Statistics, June 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- Google Safe Browsing, Google
- Security Issues report, Google Search Console Help
- Annual scam losses exceed $2 billion, ACCC, March 2026
- Quick reference guide for responding to data breaches, OAIC
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- Digital Lives of Australians 2026, auDA