New statistics from the Office of the Australian Information Commissioner (OAIC) reveal that incidents reported under the Notifiable Data Breach (NDB) scheme continue to rise, with a significant increase in the number of large-scale breaches affecting Australians in the first half of 2026.
The latest NDB statistics, covering January through June 2026, showed that the OAIC received 667 notifications, a minor increase over the 662 notifications received in the previous reporting period.
However, the statistics reveal a significant increase in breaches affecting large numbers of Australians. Breaches impacting between 100,000 and 250,000 individuals doubled from 3 to 6, while breaches affecting between 500,000 and 1,000,000 individuals rose from zero to 3. Globally, the number of breaches reported to us that impacted over 1,000,000 individuals also increased to 11, up from 4 in the prior period.
Malicious or criminal attacks remain the leading cause of Notifiable Data Breaches, with contact and identity information, including identity documents, continuing to be among the most compromised types of personal information.
Health service providers were shown to be a frequent target (149 notifications), accounting for the largest number of malicious or criminal attacks (72 notifications). This same sector also had the largest number of breaches attributable to human error (62 notifications).
Education (85 notifications), business and professional associations (79 notifications), and financial services and personal services (both with 51 notifications) followed, ranking as the top 5 sectors by volume for data breach notifications.
Australian Privacy Commissioner Carly Kind said the latest figures reinforced the need for organisations to take proactive steps to protect the personal information they hold.
“The continued rise in data breach notifications, particularly those affecting large numbers of Australians, highlights the importance of strong privacy and information security practices.
“It also underscores the importance of data minimisation. Organisations can’t lose personal information they don’t hold. All APP entities should review their practices to ensure they’re only collecting and retaining the minimum personal information necessary to perform their functions and activities.”
The latest statistics also point to improvements in the speed at which organisations are identifying and informing the OAIC of Notifiable Data Breaches. More than half of notified breaches were identified within 10 days, while the proportion of breaches taking more than 30 days to identify has declined.
“Timely detection and response are critical to minimising the harm caused by data breaches. It is encouraging to see improvements in how quickly organisations are identifying incidents, although prevention must remain the priority,” Commissioner Kind said.
Alongside the publication of the latest statistics, the OAIC has also updated its interactive NDB Statistics Dashboard to include all notifications received through to 30 June 2026.
The updated dashboard provides a publicly accessible resource for exploring trends in data breach notifications, including the causes of breaches, the sectors affected and the types of personal information compromised.
