Regulatory update
Large-scale data breaches are rising: what the latest OAIC figures mean for your business
The OAIC received 667 data breach notifications in the first half of 2026. Breaches affecting more than 100,000 Australians jumped from 3 to 13. Here is what the full dashboard shows.
On 26 October 2026 the Office of the Australian Information Commissioner (OAIC) released its latest Notifiable Data Breaches (NDB) statistics, covering January to June 2026. The overall number of notifications barely moved. The size of the breaches did.
We have gone through the OAIC’s media release and every page of its NDB statistics dashboard. This update sets out what the figures show, where the media release and the dashboard tell slightly different stories, and what lenders, credit providers and other businesses should do now.
Key takeaways
- The OAIC received 667 data breach notifications from January to June 2026, up 1% on the 662 received from July to December 2025.
- Breaches affecting more than 100,000 Australians rose to 13, up from 3 in the previous six months and 6 in the same period last year.
- Malicious or criminal attacks caused 65% of breaches. Human error caused 28% and system faults 7%.
- Cyber incidents made up 45% of all breaches. Phishing and ransomware were the most common types.
- Health service providers notified the most breaches (149). The finance sector notified 51.
- 63% of breaches were identified within 10 days, up from 54%. But only 39% were notified to the OAIC within 10 days.
On this page
- How many data breaches were notified?
- Large-scale breaches: the real story
- What is causing data breaches?
- What personal information is involved?
- Which sectors are most affected?
- How quickly are breaches found and reported?
- What the Privacy Commissioner said
- Your obligations under the NDB scheme
- What lenders and businesses should do now
- Frequently asked questions
How many data breaches were notified?
The OAIC received 667 notifications in the first half of 2026, compared with 662 in the second half of 2025. The Commissioner described this as a minor increase.
The monthly figures were uneven. Notifications started low in January and peaked in May:
| Month (2026) | Notifications |
|---|---|
| January | 65 |
| February | 94 |
| March | 97 |
| April | 109 |
| May | 167 |
| June | 135 |
May’s 167 notifications were the highest monthly figure on the dashboard’s 13-month chart, which runs from June 2025.
Large-scale breaches: the real story
Most breaches are still small. The dashboard shows 52% of breaches affected 100 people or fewer. The change is at the top end.
The dashboard’s table of large-scale breaches affecting Australians shows the following:
| Australians affected | Jan-Jun 2025 | Jul-Dec 2025 | Jan-Jun 2026 |
|---|---|---|---|
| 100,001 to 250,000 | 3 | 1 | 6 |
| 250,001 to 500,000 | 3 | 0 | 4 |
| 500,001 to 1,000,000 | 0 | 1 | 3 |
| 1,000,001 to 10,000,000 | 0 | 1 | 0 |
| Total | 6 | 3 | 13 |
Reading the media release against the dashboard
The media release says breaches affecting 100,000 to 250,000 individuals doubled from 3 to 6, and breaches affecting 500,000 to 1,000,000 rose from zero to 3. On the dashboard, those comparisons line up with January to June 2025, not with the immediately previous period. The dashboard’s own notes say its comparisons are to the previous six-month period unless otherwise indicated.
Measured against July to December 2025, the jump is sharper. Breaches affecting more than 100,000 Australians went from 3 to 13.
The release also says breaches affecting more than 1,000,000 individuals rose from 4 to 11. That figure is global. It counts individuals worldwide, not just Australians. The dashboard records no breach affecting more than 1,000,000 Australians in the first half of 2026.
What is causing data breaches?
The OAIC records the dominant or most likely source of each breach, based on what the reporting entity tells it.
| Source | Jul-Dec 2025 | Jan-Jun 2026 |
|---|---|---|
| Malicious or criminal attack | 398 | 414 |
| Human error | 194 | 178 |
| System fault | 35 | 44 |
Cyber incidents
Cyber incidents caused 45% of all breaches (302 notifications) and 73% of malicious or criminal attacks. The dashboard breaks them down as follows:
- Phishing (compromised credentials): 25%
- Ransomware: 22%
- Compromised or stolen credentials (method unknown): 18%
- Hacking: 16%
- Brute-force attack (compromised credentials): 4%
- Malware: 2%
Three of those categories involve compromised credentials. Together they account for close to half of all cyber incidents.
Human error
Human error breaches fell from 194 to 178. The top causes were personal information sent to the wrong recipient by email (42%), unintended release or publication (24%) and verbal unauthorised disclosure (8%).
What personal information is involved?
Most breaches involve more than one kind of personal information, so these figures overlap:
- Contact information: 483 breaches
- Identity information (such as passport or driver licence numbers): 359
- Health information: 212
- Financial details (such as bank account or credit card numbers): 177
- Other sensitive information: 148
- Tax file numbers: 91
One breach involved Digital ID information. None involved Consumer Data Right data.
Identity and financial details are exactly what a fraudster needs to open accounts or apply for credit. For lenders, this is a fraud risk as well as a privacy risk.
Which sectors are most affected?
The top five sectors by notifications were:
| Sector | Total | Malicious or criminal | Human error | System fault |
|---|---|---|---|---|
| Health service providers | 149 | 72 | 62 | 9 |
| Education | 85 | 53 | 26 | 4 |
| Business and professional associations | 79 | 66 | 7 | 2 |
| Finance (incl. superannuation) | 51 | 30 | 15 | 4 |
| Personal services | 51 | 25 | 22 | – |
Totals include breaches where the source is not yet known, so the columns don’t always add up.
The OAIC’s finance sector includes banks, wealth managers, financial advisers, superannuation funds and consumer credit providers, regardless of turnover. Of its 51 notifications, 30 came from malicious or criminal attacks.
How quickly are breaches found and reported?
Detection is improving. Reporting to the OAIC is slower.
| Time taken | Identify (Jul-Dec 2025) | Identify (Jan-Jun 2026) | Notify OAIC (Jul-Dec 2025) | Notify OAIC (Jan-Jun 2026) |
|---|---|---|---|---|
| 10 days or less | 54% | 63% | 31% | 39% |
| 11 to 20 days | 9% | 8% | 19% | 15% |
| 21 to 30 days | 5% | 3% | 26% | 24% |
| More than 30 days | 26% | 19% | 23% | 19% |
| Unknown | 6% | 7% | 1% | 3% |
Nearly two in three breaches were identified within 10 days. But on the dashboard’s measure, 43% of notifications took more than 20 days to reach the OAIC, and 19% took more than 30 days.
What the Privacy Commissioner said
Privacy Commissioner Carly Kind said the figures reinforce the need for proactive steps to protect personal information. She urged all entities to collect and keep only the personal information they need, noting that “organisations can’t lose personal information they don’t hold”.
She welcomed faster identification, but said “prevention must remain the priority”.
Your obligations under the NDB scheme
The NDB scheme is in Part IIIC of the Privacy Act 1988 (Cth). It applies to organisations and agencies covered by the Privacy Act. That includes most businesses with annual turnover over $3 million, and some smaller businesses such as health service providers and credit reporting bodies.
An eligible data breach happens when personal information is lost, or accessed or disclosed without authorisation, the breach is likely to result in serious harm to one or more individuals, and you haven’t been able to prevent that likely risk of serious harm with remedial action.
- If you suspect an eligible data breach, you must take reasonable steps to assess it within 30 days.
- If you have reasonable grounds to believe there has been an eligible data breach, you must notify the OAIC and affected individuals as soon as practicable.
- Your notification must include recommendations about the steps individuals should take in response.
Under APP 11, you must take reasonable steps to protect the personal information you hold, and to destroy or de-identify it once you no longer need it. More about the scheme is on the OAIC’s NDB scheme page.
What lenders and businesses should do now
- Cut down what you hold. Review what personal information you collect and how long you keep it. Destroy or de-identify what you no longer need, as APP 11 requires.
- Harden logins. With phishing and stolen credentials driving most cyber incidents, review multi-factor authentication, password controls and staff phishing training.
- Stop misdirected emails. Email to the wrong recipient is the top human error cause. Consider recipient checks, delay-send rules and secure portals for documents.
- Test your response plan. Make sure your data breach response plan covers containing, assessing, notifying and reviewing, and that staff know who decides when to notify.
- Check your vendors. Many large breaches start with a third-party provider. Review your contracts for security, breach notice and cooperation obligations.
- Look ahead to 10 December 2026. New automated decision-making transparency rules start then. See our guide to automated decisions and the Privacy Act.
The OAIC’s data breach preparation and response guidance is a useful starting point.
Frequently asked questions
What counts as a large-scale data breach?
The dashboard’s large-scale breach table starts at breaches affecting more than 100,000 Australians. The Privacy Act itself doesn’t define a large-scale breach. The test for notification is whether serious harm is likely, not how many people are affected.
Do we have to notify every data breach?
No. You must notify eligible data breaches, where serious harm is likely and remedial action hasn’t removed that risk. You should still record and assess every breach.
How long do we have to assess a suspected breach?
You must take reasonable steps to complete the assessment within 30 days of becoming aware of grounds to suspect an eligible data breach. If you then have reasonable grounds to believe it is an eligible data breach, notify as soon as practicable.
Are the 2026 figures final?
Not necessarily. The OAIC says some notifications are still being assessed, and figures for past periods may change in later dashboard updates.
Need help with a data breach or your privacy compliance?
Talk to our banking and financial services team
Banking & Financial Services Law
Our team helps lenders, credit providers and brokers prepare data breach response plans, review privacy policies and vendor contracts, and respond when a breach happens. Learn more about our data and privacy law services.
Statistics, quotes and definitions are from the Office of the Australian Information Commissioner website – www.oaic.gov.au, licensed under the Creative Commons Attribution 4.0 International Licence. Dashboard data as refreshed on 7 August 2026.
This article is general information only and is not legal advice. It reflects Australian law at the date of publication. Please contact us for advice about your circumstances.
Related updates
Posted in Data & Privacy Law