Large-scale data breaches rise sharply in first half of 2026, OAIC figures show

The Office of the Australian Information Commissioner (OAIC) has reported a significant increase in large-scale data breaches affecting Australians, with the latest Notifiable Data Breach (NDB) scheme statistics covering January to June 2026 showing a sharp rise in high-volume incidents even as the overall number of notifications held relatively steady.

The OAIC received 667 notifications in the first half of 2026, a marginal increase from 662 in the previous reporting period; however, the scale of individual breaches grew substantially.

Breaches affecting between 100,000 and 250,000 individuals doubled from three to six, while incidents affecting between 500,000 and one million individuals rose from zero to three. Breaches impacting more than one million individuals globally increased to 11, up from four in the prior period.

Malicious or criminal attacks remained the leading cause of notifiable data breaches, with contact and identity information - including identity documents - among the most commonly compromised data types.

Health service providers recorded the highest volume of notifications at 149, accounting for the largest share of malicious or criminal attacks (72 notifications) and human error incidents (62 notifications).

Education (85 notifications), business and professional associations (79 notifications), and financial services and personal services (51 notifications each) rounded out the top five sectors by volume.

Australian Privacy Commissioner Carly Kind said the figures reinforced the need for organisations to take proactive steps to protect the personal information they hold.

"The continued rise in data breach notifications, particularly those affecting large numbers of Australians, highlights the importance of strong privacy and information security practices," Kind said.

"It also underscores the importance of data minimisation. Organisations can't lose personal information they don't hold."

The statistics also pointed to improvements in breach detection times.

More than half of notified breaches were identified within ten days, and the proportion taking more than 30 days to identify has declined.

"Timely detection and response are critical to minimising the harm caused by data breaches. It is encouraging to see improvements in how quickly organisations are identifying incidents, although prevention must remain the priority," Kind said.

The OAIC has updated its interactive NDB Statistics Dashboard to include all notifications received through to 30 June 2026, providing a publicly accessible resource for exploring breach trends by cause, sector and data type.

Earlier this year, the OAIC revealed that 2025 saw the highest number of data breach notifications being reported since the mandatory data breach reporting scheme commenced.