OAIC statistics show more large-scale data breaches in the first half of 2026

The Office of the Australian Information Commissioner (OAIC) has published its latest notifiable data breach statistics, covering January to June 2026. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act report certain data breaches to the OAIC.

According to the OAIC’s release:

• it received 667 notifications in the period, compared with 662 in the previous period
• breaches affecting more than 1,000,000 people rose from 4 to 11
• breaches affecting 500,000 to 1,000,000 people rose from zero to 3
• health service providers made the most notifications (149), followed by education (85)

The OAIC says malicious or criminal attacks remain the leading cause of notified breaches, and that contact and identity information, including identity documents, is among the information most often involved. It also says more than half of notified breaches were identified within 10 days.

Who it affects

The figures relate to organisations that notified the OAIC, and to the people whose personal information was involved in those breaches.

What the OAIC says

The OAIC’s message in this release is aimed at organisations. It says they can reduce risk by collecting and keeping only the personal information they need, because information that isn’t held can’t be lost. It also says organisations can prioritise prevention while keeping detection and response fast.

Our data breaches explained guide covers what a breach is and what notification means, and identity theft explains how stolen details can be misused and where to get help.