Many Australians still remember the 2016 census because of the online outage that dominated headlines on census night. It was the first time a majority of Australians were expected to complete the census online. However, the website crashed, in what became widely known as #CensusFail .
Author
- Ritesh Chugh
Professor, Information and Communications Technology, CQUniversity Australia
It wasn’t just any crash. The Australian Bureau of Statistics (ABS) took the online census offline after a series of distributed denial-of-service attacks . Known as DDoS, these attacks overwhelm a website with internet traffic, making it unavailable to legitimate users.
While no data was ever leaked, the website was unavailable for almost two days, undermining public confidence in the security of one of Australia’s largest collections of personal information.
Ten years later, the latest census will take place on August 11 2026. This year, around 85% of Australians are expected to complete it online .
The successful 2021 census reflected the cyber security improvements the ABS had made since 2016.
So how secure is the 2026 census? What did its latest cyber security audit find, and what can Australians do to protect themselves from scams while completing it online?
Why the census is an attractive target for cyber criminals
The census is Australia’s largest national data collection exercise.
Although the information collected is protected by strict privacy laws , the sheer scale and national significance of the census make it an attractive target for cyber criminals.
It’s also one of the country’s biggest online events, with millions of Australians expected to log on to the same website and complete it within a relatively short period.
Cyber criminals are increasingly targeting governments because they hold valuable information and provide essential public services. Even if attackers can’t steal the data, they may still try to disrupt services and undermine public confidence.
Lessons from 2016
The 2016 census outage is often remembered as a major cyber security failure. While no census data was compromised, the disruption damaged public trust.
The ABS has since invested heavily in improving its cyber security. Those improvements were evident during the 2021 census , when the ABS reported repelling almost 1 billion attempted cyber attacks and blocking more than 130,000 malicious internet addresses associated with attempts to attack or disrupt the online census service.
However, cyber security is an ongoing process rather than a one-time fix. Ahead of the 2026 census, an independent audit listed several areas requiring further work.
What the audit found
In May 2026, the Australian National Audit Office found the ABS needed to address key remaining cyber security vulnerabilities and complete critical security activities before census night.
It also identified shortcomings in cyber risk management and broader planning across the bureau’s information and communication technology environment – the digital infrastructure that supports the collection, processing and protection of census data.
The audit made four recommendations:
- strengthening cyber risk management
- establishing cyber security advisory arrangements earlier in the census planning process
- improving security architecture documentation, and
- better managing risks across the ABS’s broader information and communication technologies.
In its response, the ABS said it had fully implemented the first two recommendations and had made ” substantial progress ” on the remaining two, which would be implemented before census night .
The biggest cyber risk may not be the census website
For most Australians, the greatest cyber risk is unlikely to be someone breaking into the census system.
Instead, it may be phishing scams, where cyber criminals impersonate the ABS. These can include fake emails, text messages and websites designed to trick people into handing over personal information or clicking malicious links. The bureau has warned Australians to be alert to these scams.
Scammers know many Australians will expect to receive census-related communications. By impersonating trusted organisations such as the ABS and using authentic-looking emails, text messages and websites, they can make phishing attempts appear more legitimate .
How to complete the census safely
A few simple precautions can greatly reduce your risk.
Make sure you are on the correct website. Complete your census through the official census website , your myGov inbox if you’ve subscribed to census updates, or a paper form. Double-check the web address before entering any personal information.
Stay alert. Don’t click links in unexpected emails or text messages claiming to be from the ABS. If you’re unsure whether a message is genuine, go directly to the official ABS website rather than following a link.
Be aware of misinformation. The ABS will never offer prizes or incentives for completing your census. The bureau will also not ask for passwords, banking details, tax file numbers or identity documents.
If you receive a suspicious message claiming to be from the ABS, report it to the bureau itself and to Scamwatch .
Every census depends on public trust. While the ABS has strengthened its cyber defences since 2016, Australians also have an important role to play by recognising scams and using official census channels. A quick check to confirm that a message or website is genuine can help protect your personal information.
