Data breaches hitting hundreds of thousands of Australians are rising

Big data breaches are becoming more common. More breaches now hit hundreds of thousands of Australians at a time.

The Office of the Australian Information Commissioner (OAIC) published its latest Notifiable Data Breach statistics on 26 October. They cover January to June 2026.

The total barely moved. The size of breaches did

The OAIC received 667 notifications in the six months, just above the 662 it received in the previous six months. For context, 2025 was already the busiest year since the scheme began in 2018, with 1,205 notifications.

The change is at the big end:

• Breaches affecting 100,000 to 250,000 people doubled, from three to six.
• Breaches affecting 500,000 to 1,000,000 people went from none to three.
• Breaches reported to the OAIC that affected more than a million people worldwide rose from four to 11.

So the number of breaches is steady, but more of them now reach hundreds of thousands of people.

Criminals are still the main cause

Malicious or criminal attacks remain the leading cause of notified breaches. Contact and identity information, including identity documents, are still among the details most often taken.

That matters after the breach, too. The OAIC warns that if your name and contact details were taken, a scam email might be personalised and address you by name.

Health providers top the list again

Health service providers reported 149 breaches, more than any other sector. They also had the most criminal attacks (72) and the most breaches caused by human error (62).

The rest of the top five:

Sector	Notifications
Health service providers	149
Education	85
Business and professional associations	79
Financial services	51
Personal services	51

Private health service providers have to follow the scheme whatever their size, so a small clinic is covered just like a hospital group. Our explainer on when a small business has to report a data breach sets out who else is covered.

“Organisations can’t lose personal information they don’t hold”

Privacy Commissioner Carly Kind said the rise in large breaches “highlights the importance of strong privacy and information security practices”.

She also stressed data minimisation. “Organisations can’t lose personal information they don’t hold,” she said. She urged every organisation covered by the Privacy Act to collect and keep only the personal information it needs.

There was some good news. Organisations are spotting breaches faster. More than half of notified breaches were identified within 10 days, and a smaller share took more than 30 days to find.

Who has to report a breach

The scheme covers Australian Government agencies, and businesses and not-for-profits with annual turnover above $3 million. It also covers private health service providers, credit reporting bodies, credit providers and some smaller businesses, such as those that handle tax file numbers.

The OAIC’s quick reference guide sets out four steps after a breach: contain it, assess it, notify if required, then review what went wrong.

If you’d like to dig into the numbers, the OAIC’s interactive Notifiable Data Breach statistics dashboard now includes notifications up to 30 June 2026.

If you get a breach notice

The OAIC’s guide to responding to a data breach notification says to act quickly and keep a record of what you do. What to do depends on what was taken, and the checklist covers the main cases.

Checklist

• Read the whole breach notice. It should say which of your details were involved and what the organisation recommends you do.
• Change your email password if your contact details were taken. Use a strong password you haven’t used anywhere else, and turn on multi-factor authentication.
• Call back on a number you look up yourself. If someone rings claiming to be from a company or agency, hang up and call the number on its official website.
• Contact your bank directly if financial details were involved. Type its web address into your browser rather than clicking a link, and change your online banking password and PIN.
• Contact the issuing agency if an ID document was involved. Ask the agency that issued your driver licence, Medicare card or passport what to do next.
• Keep a record of every step you take. Note dates, who you spoke to and what you changed, in case you’re harmed later.
• Business owners: list the personal information you hold. Delete what you no longer need, as the Privacy Commissioner recommends.
• Business owners: check whether the breach scheme covers you. Annual turnover over $3 million, running a private health service, or handling tax file numbers can all bring you in.