Data breach notifications hit a record 1,205 in 2025, with health the most affected sector
That is up 8 per cent on 2024 and the highest since the scheme began in 2018. Malicious or criminal activity caused 716 of them.
On this page
The 2025 figures
The Office of the Australian Information Commissioner published the 2025 Notifiable Data Breaches figures on 6 July 2026, against 1,112 notifications in 2024. It names cyber attacks as the primary cause of the malicious and criminal breaches.
Sector: Health service providers
- Notifications
- 225 (19 per cent)
Sector: Financial services
- Notifications
- 157
Sector: Australian Government
- Notifications
- 118
Sector: Business and professional associations
- Notifications
- 103
Sector: Education
- Notifications
- 81
Sector: Legal, accounting and management services
- Notifications
- 81
| Sector | Notifications |
|---|---|
| Health service providers | 225 (19 per cent) |
| Financial services | 157 |
| Australian Government | 118 |
| Business and professional associations | 103 |
| Education | 81 |
| Legal, accounting and management services | 81 |
| Item | Value |
|---|---|
| Health service providers | 225 |
| Financial services | 157 |
| Australian Government | 118 |
| Business and professional associations | 103 |
| Education | 81 |
| Legal, accounting and management services | 81 |
What the numbers mean for a regulated business
Financial services came second to health, and legal, accounting and management services sit level with education. Each of those sectors holds information whose exposure is likely to cause serious harm, which is the test that makes a breach notifiable.
The OAIC also released a quick reference guide and a self-assessment checklist covering when an assessment is needed and how to notify the OAIC and affected individuals.
What to have ready before a breach
An entity that suspects an eligible data breach has 30 days to assess it, and must notify the OAIC and affected people as soon as practicable once it has reasonable grounds to believe one occurred.
- A data inventory that says which systems hold health, financial and identity information
- Logs kept long enough to show what an attacker accessed
- A named decision-maker for the serious harm assessment
- Draft notices for the OAIC and for affected individuals
Sources
- PrimaryOAIC, Data breach notifications increase to all-time high in 2025, new NDB stats show (6 July 2026)Retrieved 25 Oct 2026
