Short answer
The OAIC released its Notifiable Data Breaches statistics for January to June 2026 on 26 October 2026. It received 667 notifications, up from 662, while breaches affecting more than 1,000,000 people rose from four to 11. Malicious or criminal attacks remained the leading cause.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Office of the Australian Information Commissioner (OAIC) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Cross-sector regulator statistics |
| Country | Australia |
| Disclosed | 2026-10-26 |
| People or records affected | 667 notifications under the Notifiable Data Breaches scheme, January to June 2026 |
What data was exposed
- Contact and identity information, including identity documents, was the most commonly compromised type
- Health service providers filed the most notifications (149), followed by education (85)
What the regulator reported
On 26 October 2026 the Office of the Australian Information Commissioner (OAIC) released its Notifiable Data Breaches (NDB) statistics for January to June 2026. It received 667 notifications, a slight rise on the 662 in the previous period, according to the OAIC’s media release. The number is steady, but the size of the largest breaches grew.
Large breaches are growing
Breaches affecting more than 1,000,000 people rose from four to 11. Those affecting 500,000 to 1,000,000 people rose from none to three, and those in the 100,000 to 250,000 range rose from three to six, as Cyber Daily also reports. Malicious or criminal attacks remain the leading cause, and the most compromised data is contact and identity information, including identity documents.
Sectors and speed
Health service providers filed the most notifications at 149, of which 72 came from malicious or criminal attacks and 62 from human error, the largest human-error count of any sector. Education followed with 85, then business and professional associations (79), financial services (51) and personal services (51).
The OAIC says detection is improving: more than half of breaches were identified within 10 days, and the share that took over 30 days to identify declined. The updated NDB dashboard now covers notifications through 30 June 2026.
Privacy Commissioner Carly Kind said “organisations can’t lose personal information they don’t hold” and urged organizations to collect and keep only the minimum they need. She also said prevention must remain the priority alongside timely detection and response.
Why this matters for you
Each large breach leaves behind a pool of names, contact details and ID information that scammers reuse for months. A text that quotes your real details is no proof that it comes from the company. Our guide to phishing messages explains how to verify a link, and what to do after a data breach lists the steps. When a caller pretends to be an agency, see government impersonation scams.
What this report does not tell us
These are counts of notifications, not of people, and the sources we read do not name the 11 largest breaches or give total people affected. We have not read the full PDF report, only the OAIC release and Cyber Daily’s summary. See our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Scammers use well-known breach headlines to pose as the affected company or the regulator and ask you to confirm details
- Stolen contact and identity details make impersonation calls and texts more convincing
- Fake breach-compensation or identity-protection offers that ask for payment or ID documents
What to do if you are affected
- 01If a company tells you your data was involved in a breach, confirm the notice through its official website or a published phone number, not a link in the message.
- 02Change reused passwords, turn on multi-factor authentication and watch for new accounts opened in your name.
- 03Be wary of anyone who offers to remove or recover leaked data for a fee.
- 04Ask organizations you deal with to delete data they no longer need, as the Privacy Commissioner suggests they should.
- 05Report scams to Scamwatch and get help from IDCARE if your identity documents were exposed.
Frequently asked questions
How many data breaches were notified to the OAIC in January to June 2026?
667, up slightly from 662 in the previous reporting period, according to the OAIC.
How many large breaches were there?
Breaches affecting more than 1,000,000 people rose from four to 11. Those affecting 500,000 to 1,000,000 rose from none to three, and 100,000 to 250,000 rose from three to six.
Which sectors reported the most breaches?
Health service providers with 149 notifications, then education (85), business and professional associations (79), and financial services and personal services (51 each).
What is the main cause of breaches?
Malicious or criminal attacks remain the leading cause. Health providers also reported 62 human-error breaches, the largest count for that cause.
Is breach detection getting faster?
The OAIC says more than half of breaches were identified within 10 days and the share taking over 30 days to identify declined.
Sources
- Large scale data breaches on the rise, latest OAIC statistics reveal, Office of the Australian Information Commissioner, 2026-10-26
- Stat dump: data breaches impacting Aussies continue to rise, OAIC says, Cyber Daily, 2026-10-26
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.