The Office of the Australian Information Commissioner (OAIC) released its latest Notifiable Data Breach (NDB) statistics for January 2026 to June 2026, revealing that reported incidents continue to rise, with a significant increase in large-scale breaches affecting hundreds of thousands of Australians during the first half of the year.
Breaches impacting between 100,000 and 250,000 individuals doubled from 3 to 6, while breaches affecting between 500,000 and 1,000,000 individuals rose from zero to 3.
Malicious or criminal attacks remain the leading cause of NDBs, with 414 notifications made to the OAIC during the six-month period. Cyber incidents, including phishing, ransomware, compromised credentials and hacking, continue to be the primary source of reported breaches.
Human error accounted for 28% of data breaches, with the majority resulting from personal information being sent to the wrong recipient, followed by unauthorised disclosure.
Contact, identity, and health information were the most commonly involved categories of personal information, followed by financial details, other sensitive information, and tax file numbers.
Health service providers were a frequent target, accounting for the largest number of malicious or criminal attacks, followed by business and professional associations. The health sector also recorded the highest number of breaches attributable to human error.
Education, business and professional associations, financial services and personal services rounded out the top five sectors by volume of data breach notifications.
Australian Privacy Commissioner Carly Kind said:
“The latest figures reinforced the need for organisations to take proactive steps to protect the personal information they hold.
“The continued rise in data breach notifications, particularly those affecting large numbers of Australians, highlights the importance of strong privacy and information security practices.
“It also underscores the importance of data minimisation. Organisations can’t lose personal information they don’t hold. All APP entities should review their practices to ensure they’re only collecting and retaining the minimum personal information necessary to perform their functions and activities.”
With privacy breaches continuing to rise and regulatory scrutiny increasing, organisations should ensure their privacy compliance frameworks, data governance practices and incident response plans remain fit for purpose.
To view the statistics, see the NDB dashboard here: Notifiable Data Breach statistics dashboard | OAIC
Source: OAIC Large-scale data breaches on the rise, latest OAIC statistics reveal | OAIC
Contact us
If you require assistance with privacy compliance, data breach response or privacy governance, please contact a member of our Privacy & Data Protection team.
| Disclaimer: This publication contains comments of a general nature only and is provided as an information service. It is not intended to be relied upon, nor is it a substitute for specific professional advice. No responsibility can be accepted by Rigby Cooke Lawyers or the authors for loss occasioned to any person doing anything as a result of any material in this publication.
Liability limited by a scheme approved under Professional Standards Legislation. © 2026 Rigby Cooke Lawyers |