Report
Australian notifiable data breaches, read for small and mid-sized firms
Attackers caused most of the breaches reported in 2025, and the sectors that hold health, financial and privileged client records reported the most. A small or mid-sized firm in those sectors defends the same information with fewer people.
- OAIC figures of 6 Jul 2026, read 26 Oct 2026
- PDF, 7 pages, 230 KB
- BS-RPT-01, version 1.0
Executive summary
The OAIC received 1,205 data breach notifications in the 2025 calendar year, up 8 per cent on 1,112 in 2024 and the most in any year of the scheme. That is 93 more notifications than in 2024, and more than three for every day of the year.
Malicious or criminal activity caused 716 of the 1,205 notifications, 59 per cent. The other 489 came from the scheme’s two other causes, human error and system faults.
Health service providers made 225 notifications, 19 per cent of the total and the most of any sector. Financial services made 157, the Australian Government 118, business and professional associations 103, education 81, and legal, accounting and management services 81.
Each notification is an organisation that found a breach likely to cause serious harm to the people whose information it held, and reported it. For a small or mid-sized firm the sector table answers a practical question: whether the organisations that hold the same kind of information are being breached, and by what route.
Most breaches in the year came from attackers, so the controls that stop a stolen password or a malicious attachment carry most of the weight. The rest came from mistakes and faults, which a firm reduces with fewer people holding access, a list of where personal information sits, and a rehearsed first hour.
- Know where your personal, health and financial information sits, and who can reach it.
- Put phishing-resistant multi-factor authentication on email and every system that holds client records.
- Keep logs long enough to show what an attacker touched, and name the person who decides whether a breach is notifiable.
Report
The figures
Notifications and their causes, 2024 and 2025
Notifications by sector, 2025
What to do
An entity that suspects an eligible data breach has 30 days to assess it, then must notify the OAIC and the people affected as soon as practicable. The work that decides how those days go is done before the breach.
- Write down which systems hold health, financial and identity information, who can reach each one, and which suppliers hold copies.
- Enforce phishing-resistant multi-factor authentication on email, remote access and every system on that list, with the exceptions named and dated.
- Keep sign-in and access logs long enough to answer the question the assessment asks: what did the attacker see.
- Name the person who decides whether a breach is likely to cause serious harm, and the deputy who decides when they cannot be reached.
- Draft the notice to the OAIC and the notice to affected people now, with the facts left blank.
- Confirm every change to payment details by calling a number you already hold.
- Make backups that a compromised administrator account cannot delete, and time a restore.
- Ask each supplier that holds your clients’ information how and when it will tell you about a breach, and put the answer in the contract.
Our free breach notification helper walks through the serious harm assessment in the browser, with nothing sent to us. A firm that wants the work done can engage our breach remediation team, which contains the incident, establishes what was reached and supports the assessment and the notices.
Method
Every figure comes from the release the Office of the Australian Information Commissioner published on 6 July 2026 with the Notifiable Data Breaches statistics for the 2025 calendar year. We opened and read the release on 25 and 26 October 2026 and print each figure as the OAIC states it.
Three figures are our arithmetic on the OAIC’s own: the difference between the two years, the notifications not attributed to malicious or criminal activity, and the share made by the six largest sectors. Percentages are rounded to whole numbers, the way the OAIC rounds its own.
The scheme covers the agencies and organisations the Privacy Act binds. The Privacy Act’s small business line sits at A$3 million in annual turnover, and a business that provides a health service and holds health information is covered whatever its turnover. A firm under the turnover line that suffers a breach is often outside the count, so the figures understate what happens to the smallest businesses.
Notifications are counted by the sector of the organisation that made them. Where several organisations hold the same breached information, one may notify for all of them, so a single notification can stand for a breach that reached many firms.
BS-RPT-01, published 26 Oct 2026
The full report, as a PDF
PDF, 7 pages, 230 KB. OAIC figures of 6 Jul 2026, read 26 Oct 2026.
More reports
Report
Security events by hour: what our monitoring sees
Measured 26 Oct 2026, 00:45 AEST · PDF, 6 pages, 305 KB
