This figure is probably conservative.  Many breaches take well over a year to detect.  There is increasing pressure for disclosure, still more overseas than in Australia but it is coming.  There are some relatively simple steps business can take to increase their cyber resilience.