The number of data breaches reported under Australia’s Notifiable Data Breach scheme has risen to 667 in the first half of the year, an increase of only five compared to the previous reporting period in 2025.
However, new statistics released today by the Office of the Australian Information Commissioner show a sharp rise in the number of Australians impacted by breaches.
Breaches that impacted between 100,000 and 250,000 individuals rose from three to six, while breaches affecting between 500,000 and 1,000,000 individuals rose from zero to three.
However, breaches reported to the OAIC that impacted more than 1,000,000 individuals rose from four in the prior period to 11 in the first half of 2026.
“The continued rise in data breach notifications, particularly those affecting large numbers of Australians, highlights the importance of strong privacy and information security practices,” Australian Privacy Commissioner Carly Kind said in an October 26 statement.
“It also underscores the importance of data minimisation. Organisations can’t lose personal information they don’t hold. All APP entities should review their practices to ensure they’re only collecting and retaining the minimum personal information necessary to perform their functions and activities.”
The OAIC said that “Malicious or criminal” activity was the main driver of reported breaches.
Health providers made 149 notifications, including 72 notifications of malicious cyberattacks, making it the most impacted sector, followed by the education sector (85 notifications), business and professional associations (79 notifications), and financial and personal services (51 notifications each).
It’s not entirely bad news, though. The OAIC noted that organisations are getting better at reporting breaches in a timely manner.
More than half of breaches were reported within 10 days, while breaches taking more than 30 days to identify have declined year-on-year.
“Timely detection and response are critical to minimising the harm caused by data breaches. It is encouraging to see improvements in how quickly organisations are identifying incidents, although prevention must remain the priority.”
The new data has also been integrated into the OAIC's Notifiable Data Breaches dashboard.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
