Report
How long Australian organisations took to find and report a breach, July to December 2025
In the second half of 2025, over half of the malicious breaches reported to the OAIC with a known time were found within ten days, and over half took more than 30 days to notify. The time is lost between finding the breach and deciding what it is, and a rehearsed assessment shortens that delay.
- OAIC data of 1 Jul to 31 Dec 2025, read 28 Jul 2026
- First published 28 Jul 2026, this edition 29 Oct 2026
- PDF, 6 pages, 232 KB
- BS-RPT-11, version 1.2
Executive summary
Australian organisations and agencies made 670 data breach notifications to the OAIC from 1 July to 31 December 2025. Malicious or criminal attacks accounted for 405 of the 670 notifications, human error for 194 and system faults for 35; the remaining 36 were recorded as other or currently unknown.
Malicious or criminal attacks took more than 30 days to notify the OAIC in 213 of the 382 cases with a known time, 56 per cent, and more than 30 days to identify in 113 of 373, 30 per cent. Of the 192 human error breaches with a known time to notify, 71 were notified within 10 days, 37 per cent, 29 took 11 to 20 days, 22 took 21 to 30 days and 70 took more than 30 days, 36 per cent.
An entity that suspects an eligible data breach has 30 days to assess it, then must notify the OAIC and the people affected as soon as practicable. The OAIC counts the time to notify from the day the organisation became aware of the breach, so a notification after more than 30 days has run past the window the Act allows for the assessment. In the half year, that was the outcome for most malicious attacks and for more than a third of the breaches caused by error.
The figures separate two problems that are usually treated as one. Finding the breach was the quicker half: most of those with a known time were known within ten days of happening. Working out what was taken, deciding whether the harm is likely to be serious, and getting the notice out was the slower half, and it is the half a firm controls. A firm that has decided in advance who makes the call, what facts they need and where those facts are kept finishes the assessment in days. A firm deciding those things during the breach spends its 30 days on them.
- Name the person who decides whether a breach is likely to cause serious harm, and the deputy who decides when they are away.
- Keep the sign-in, mailbox and file access logs that answer what was reached, for longer than an attacker stays unnoticed.
- Run the assessment as a drill once a year against a made-up breach, and time it.
Report
The figures
Days to identify and days to notify, by source of breach
What to do
The drill below takes an afternoon. Run it against a made-up breach, a mailbox taken over for three weeks, and time each step. Where a step takes longer than a day, that is where the 30 days will go.
- Write down who decides whether a breach is likely to cause serious harm, and who decides when they are away. Give both the OAIC’s test on one page.
- Write down what starts the clock: any report of a suspected breach, from anyone, logged with its date and hour.
- List the systems that hold personal, health, financial and identity information, and the person who can pull an export from each one within a day.
- Confirm that sign-in logs, mailbox audit logs and file access logs are on, and that they are kept for months: three in ten malicious breaches took more than 30 days to find, and the logs must still cover the day the attacker arrived.
- Draft the notice to the OAIC and the notice to affected people now, with the facts left blank, and keep them where the decider can reach them without the IT provider.
- Agree with each supplier that holds your clients’ information how quickly it will tell you about a breach, and put the number of days in the contract.
- Set the standard for your own firm: a decision within ten days of the first report, and the notices the same day as the decision.
- Run the drill again when the decider changes, and once a year regardless.
Our free breach notification helper walks the serious harm assessment in the browser, with nothing sent to us. A firm that wants the drill run for it can engage us for breach readiness: we run the exercise with the directors, write the decision roles and the two notices, check that the logs answer the four facts, and leave a plan dated to the Act’s windows. When a breach is live, our breach remediation team contains it, establishes what was reached and supports the assessment and the notices.
Method
Every figure comes from the dataset the Office of the Australian Information Commissioner published on data.gov.au for the notifications it received from 1 July to 31 December 2025, which its release of 6 July 2026 links. We read every table on 28 July 2026 and print each count as the OAIC states it.
The OAIC reports the days taken to identify a breach and the days taken to notify it in four bands: 10 days or fewer, 11 to 20 days, 21 to 30 days and more than 30 days. Time to identify counts the days from the breach occurring to the organisation becoming aware of it. Time to notify counts the days from awareness to the notification reaching the OAIC. The OAIC leaves out notifications whose dates fall outside the range, so the time tables add to fewer than the half year’s total, and every percentage is of the notifications with a known time, rounded to a whole number.
The scheme covers the agencies and organisations the Privacy Act binds. The Privacy Act’s small business line sits at A$3 million in annual turnover, and a business that provides a health service and holds health information is covered whatever its turnover. A breach at a business under the turnover line is usually outside the count, so the figures understate what happens to the smallest firms, and say nothing about how quickly they find out.
The assessment drill
When the clock starts. The 30 days begin when someone in the organisation has reasonable grounds to suspect an eligible breach: the moment a mailbox rule is found, a supplier rings, or a laptop is reported missing. The clock does not wait for the investigation to finish or for the facts to be certain. A firm that treats the first report as the start, and writes the date down, knows where it stands on every later day.
Who decides. One named person decides whether the breach is likely to cause serious harm to the people whose information was involved, with a deputy for the days they cannot be reached. The investigators report facts to that person; the decision stays with them whatever the investigation finds. In a small firm the decider is usually a director, and the drill is the first time most directors learn the test they will be applying.
What evidence. The assessment needs four facts: what information was involved, whose it was, who had access to it and for how long, and whether it was protected or has since been recovered. The first two come from the system that held the data. The third comes from sign-in logs, mailbox audit logs and the file access trail, and it is the fact most firms cannot establish, because the logs were never turned on or were kept for less time than the attacker spent inside. The fourth is a judgement on the first three.
How it ends. The assessment ends with a dated decision: the breach is notifiable and the notice to the OAIC and the notices to the people affected go the same day, or serious harm is unlikely and the reasons are kept with the file. Notices drafted in advance, with the facts left blank, turn the last step from a day of writing into an hour of filling in.
BS-RPT-11, published 28 Jul 2026, revised 29 Oct 2026
The full report, as a PDF
PDF, 6 pages, 232 KB. OAIC data of 1 Jul to 31 Dec 2025, read 28 Jul 2026.
More reports
Report
Security events by hour: what our monitoring sees
Measured 26 Oct 2026, 00:45 AEST · PDF, 6 pages, 213 KB
