Data breaches and breach notifications explained

A data breach happens when personal information held by an organisation or government agency is lost, or is accessed or shared without permission. In Australia, many organisations have to tell affected people when a breach is likely to cause them serious harm.

Getting a breach notification can be unsettling, especially when the email arrives with little detail and a lot of corporate language. This guide explains what a breach is, how the notification scheme works, what a notice should tell you, how to check whether you’re affected, and the steps the Office of the Australian Information Commissioner (OAIC) and the ACSC describe.

What counts as a data breach

The OAIC describes a data breach as the loss of personal information an organisation or agency holds, or unauthorised access to or disclosure of it. Its examples include:

• a lost or stolen device holding customer information
• a hacked database containing personal information
• personal information sent by mistake to the wrong person.

Not every breach involves criminals. A misdirected email or a lost laptop can be a breach too.

Why breached information matters

Breached data is useful to criminals in ways that aren’t always obvious. The ACSC says breached information could lead to compromised online accounts, including banking, and be used in targeted scams or identity theft.

• Contact details (name, email, phone, address) make scam messages more convincing. A scam that uses your real name and mentions a company you deal with is harder to dismiss.
• Passwords can be tried on other sites where the same password was used. That’s why the ACSC says to avoid reusing passwords. See how to secure your online accounts.
• Identity documents such as licence or passport numbers can be used to open accounts in someone’s name. See identity theft explained.

The Notifiable Data Breaches scheme

The Notifiable Data Breaches (NDB) scheme was set up by the Privacy Amendment (Notifiable Data Breaches) Act 2017. The OAIC explains that any organisation or agency covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a data breach is likely to result in serious harm to someone whose information is involved.

According to the OAIC:

• Serious harm must be likely, not just possible. Examples include identity theft, financial loss through fraud, a likely risk of physical harm, serious psychological harm and serious harm to reputation.
• There’s time to assess. An organisation generally has 30 days to assess whether serious harm is likely.
• Fixing it early can change the outcome. The OAIC expects organisations to try to reduce the chance of harm, and if that works and serious harm is no longer likely, the organisation doesn’t need to notify individuals.
• The OAIC is told too. Organisations must also report serious breaches to the OAIC.

What a notification is meant to tell you

The OAIC says a notification should include:

1. the organisation or agency’s name and contact details
2. a description of the data breach
3. the kinds of personal information involved
4. recommended steps you can take in response.

A notification may arrive by email, text message or phone call. If an organisation can’t reach everyone, the OAIC says it must put the notification on its website.

A fictional example

Sam receives an email from shop.example, an online store he used a few years ago. It says the store’s customer database was accessed without authorisation. Names, email addresses, phone numbers and order histories were involved; payment details were not. The email lists steps: change your password, turn on multi-factor authentication, and watch for scam messages.

Sam remembers he used the same password for that store and for his email account. He changes both, starting with his email, and turns on multi-factor authentication.

Two days later he gets a text that appears to come from the store: “We’re sorry. Claim your $50 compensation here,” with a link. It uses his first name. Sam doesn’t tap it. Instead he opens the store’s website by typing the address himself, and finds no mention of compensation.

That second message is the kind of follow-up the ACSC and IDCARE warn about: scammers may pose as the breached organisation, and personalised messages are possible when names and contact details were involved.

This example is fictional. Names and the website are invented.

How to check a notice and whether you’re affected

How to check a notification is genuine

The ACSC says “Scammers might try to take advantage of you when a data breach occurs”, and that they “may pose as an organisation in communications such as email, text, or phone” (see phishing emails, texts and calls). IDCARE says it has “seen scammers now target breach notifications”. Based on the ACSC’s and IDCARE’s guidance:

• The ACSC says to “confirm any communications from an organisation with an official source, such as their website”, and not to use the links or contact details in the message. It describes visiting the official website and logging in, or calling the organisation’s own phone number.
• IDCARE says that if you’re in doubt, you can ask the breached organisation to confirm specific details about the notification you received.
• IDCARE also says to “never feel pressured to respond to a communication”, and never to give remote access to your computer to someone who says they are calling to “check your security”.

How to check whether you were affected

The ACSC’s recovery guide describes these official routes (checked October 2026):

1. Look for a direct notification from the organisation, by email, text or letter.
2. Check the organisation’s official communications, such as its website, by typing the address yourself rather than following a link.
3. Ask the organisation. The OAIC’s complaints page describes contacting the organisation and asking for details, including whether your information was involved.
4. Use the ACSC’s “Have you been hacked?” tool at cyber.gov.au. The ACSC says to select “My information has been lost or stolen”.

The ACSC’s page also links a free third-party lookup that checks an email address or phone number against publicly known breaches. It only covers breaches that have become public.

How to check your saved passwords

Some password managers built into phones and browsers flag saved passwords that have appeared in a data leak.

Google Password Manager (based on Google’s instructions, checked October 2026; Google’s guide has the latest steps):

1. In a browser, go to passwords.google.com and sign in.
2. Select Go to Password Checkup, then Check passwords.
3. Google says the results show passwords that are compromised (published online), reused across accounts, or weak.

In Chrome on a computer, Google’s page says the same check is under More > Passwords and autofill > Google Password Manager, then Checkup on the left.

Apple Passwords on iPhone. Apple’s iPhone User Guide says the Passwords app identifies passwords that are weak or “have been found in data leaks”, and explains how to replace them.

See also password managers.

If you’ve been affected

The OAIC’s “Respond to a data breach notification” sets out steps by type of information. It also says to act quickly and keep a record of any action you take or help you get.

For any breach, the OAIC describes contacting the organisation for more information, and considering a support service or reaching out to family or friends.

Contact details (email, phone, address). The OAIC describes changing email passwords to strong ones not used for other accounts, turning on multi-factor authentication for email where possible, not opening attachments or clicking links in messages from strangers, and not sharing personal information until you are certain who you’re sharing it with.

Financial information. The OAIC describes changing online banking passwords and your banking PIN, monitoring transactions, reporting purchases you didn’t make to your financial institution, requesting a copy of your credit report (it notes credit reporting bodies “may hold different information about you”), and requesting a ban on your credit report if fraud is suspected. See identity theft explained for how a credit ban works.

Government-issued ID and tax information. The OAIC says to contact the agency that issued the identity document for advice. For a tax file number, it points to the Australian Taxation Office, which it says can monitor unusual or suspicious activity with your tax file number.

Health information. The OAIC describes contacting the health service provider using the contact details on its website, and, if distressed, a doctor, a support service, or family and friends. If physical safety is at risk, the OAIC says to contact the police.

The ACSC’s recovery steps add reviewing which devices have recently signed in to your accounts and logging out any you don’t recognise (see what to do if an account has been hacked), contacting your bank or financial institution immediately if your money may be at risk, and reporting cybercrime through ReportCyber. The ACSC’s page lists the Australian Cyber Security Hotline as 1300 CYBER1 (1300 292 371).

IDCARE’s contact page says it offers “expert assistance with identity theft, cyber incidents, and data breaches”. Its contact page lists 1800 595 160 for individuals and 1800 595 170 for small business and organisations.

If you’re unhappy with how a breach was handled

The OAIC’s “Make a data breach complaint” describes this path:

1. Complain to the organisation or agency first, and ask for details, including whether your information was involved.
2. Allow time for a response. The OAIC says, “We think that 30 days is a reasonable period.”
3. Complain to the OAIC if there’s no response or you’re not satisfied. The OAIC says complaints must be in writing and it can’t take them by phone.

Common questions

What do I do if I get a data breach notification?

Start by checking the notice is genuine, then find out what information was involved. The OAIC sets out steps by type of information, such as changing email passwords and turning on multi-factor authentication if contact details were involved, or contacting your bank if financial details were. It also says to act quickly and keep a record of what you do. See if you’ve been affected.

How do I know if a data breach email is genuine?

The ACSC says to “confirm any communications from an organisation with an official source, such as their website”, and not to use the links or contact details in the message. It describes visiting the official website and logging in, or calling the organisation’s own phone number. IDCARE says you can ask the organisation to confirm specific details. See how to check a notification is genuine.

How do I check if my information was in a data breach?

The ACSC’s recovery guide describes four routes: looking for a direct notification, checking the organisation’s official website by typing the address yourself, asking the organisation, and using the ACSC’s “Have you been hacked?” tool at cyber.gov.au. Some password managers built into phones and browsers also flag saved passwords found in data leaks. See how to check whether you were affected.

Do I need to change all my passwords after a data breach?

The ACSC says to change the password for the affected account and any other account where the same password was used, using a unique password for each. If contact details were involved, the OAIC also lists changing email passwords to strong ones not used for other accounts. Google’s and Apple’s built-in password managers can show reused or leaked passwords. See how to check your saved passwords.

Will I always be told if my data is in a breach?

Not necessarily. The OAIC explains that organisations only have to notify when serious harm is likely, and that if early action means serious harm is no longer likely, they don’t need to notify individuals. Organisations that can’t reach everyone must put the notification on their website. Asking the organisation directly is the route the OAIC describes. See the Notifiable Data Breaches scheme.

How do I complain about a data breach in Australia?

The OAIC describes complaining to the organisation or agency first and allowing time for a response; it says “30 days is a reasonable period”. If there’s no response or you’re not satisfied, you can complain to the OAIC, which says complaints must be in writing and can’t be taken by phone. See if you’re unhappy with how a breach was handled.

Where to report and get help

• IDCARE: free support after a data breach, 1800 595 160 (1800 595 170 for small business and organisations).
• ReportCyber: the ACSC’s recovery steps include reporting cybercrime. The Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371).
• The OAIC: for complaints about how a breach was handled, after complaining to the organisation first.

See where to report scams and cybercrime in Australia for a directory of official services, and Scamwatch at scamwatch.gov.au for current scam warnings. If identity documents were involved, identity theft explained covers credit bans and replacing documents.