Developing a Harm Index for Individual Victims of Cybercrime

By Isabella Voce and Anthony Morgan

The cost of cybercrime is often expressed in terms of the financial loss to individuals, businesses and governments. This report argues that in order to invest the necessary financial, human and technical resources in prevention and response, perceived harm must be widened to include practical, health, social, financial and legal impacts.

The authors propose a harm index for victims, using a novel approach that draws on victim self-report data collected through the Australian Cybercrime Survey. The index provides a measure of the relative severity of each of 17 types of cybercrime, calculated based on victim reports of the prevalence and severity of each harm.

Key findings

Nearly half of all respondents had been a victim of at least one type of cybercrime in the 12 months prior to the survey.

Cybercrime victims experience a range of harms arising from their victimisation. Practical, social and health impacts were the most common harms experienced, followed by financial and legal difficulties.

Most cybercrime harm (71%) is concentrated among victims who did not lose any money in the most recent incident (82% of victims).

Harm can be reduced when incidents are successfully disrupted or steps are taken to minimise the impact on victims.

Certain groups are over-represented as victims, with this over-representation even more pronounced when the level of harm is taken into account.

Repeat victimisation is also common: 11% of individuals accounted for 58% of the harm reported in the survey.

There was a significant relationship between a victim’s total harm score and their likelihood of seeking help from the police.

Trends & issues in crime and criminal justice 706

Canberra: Australian Institute of Criminology, 2025. 21p.