Cybersecurity can sometimes feel overwhelming.
New threats emerge, technology changes and businesses are regularly reminded of the potential consequences of a cyber incident. But the latest Australian data breach statistics shouldn’t simply be viewed as another reason to worry.
They provide organisations with an opportunity to look at what they can control.
The latest statistics from the Office of the Australian Information Commissioner (OAIC) show 667 notifiable data breaches were reported between January and June 2026, compared with 662 in the previous reporting period.
While the overall number remained relatively stable, some breaches became considerably larger.
Breaches affecting between 100,000 and 250,000 people doubled from three to six, while breaches affecting between 500,000 and one million people increased from zero to three. Globally, breaches reported to the OAIC affecting more than one million people increased from four to 11.
For Australian organisations, these figures provide a useful reminder: cybersecurity is not only about stopping attacks. It’s about understanding your risk, protecting the information entrusted to you and being prepared to respond when something goes wrong.
Malicious or criminal attacks remained the leading cause of notifiable data breaches during the first half of 2026. Contact and identity information, including identity documents, remained among the most commonly compromised types of personal information.
However, cybercriminals aren’t the only source of risk.
The health sector, for example, recorded 149 notifications, including 72 attributed to malicious or criminal attacks and 62 to human error.
Education recorded 85 notifications, while business and professional associations recorded 79. Financial services and personal services each recorded 51
That distinction matters.
Technology is an important part of cybersecurity, but strong security also depends on people, processes and how organisations manage the information they hold.
The OAIC figures are encouraging.
More than half of notified breaches were identified within 10 days, and the proportion taking longer than 30 days to identify has declined.
Faster detection matters because the earlier an organisation identifies suspicious activity, the sooner it can investigate, contain the incident and begin its response.
But as Australian Privacy Commissioner Carly Kind noted, prevention remains the priority.
So what can organisations practically do?
A key part of protecting data is knowing what you have in the first place.
Businesses can accumulate personal information across CRM systems, email accounts, shared folders, cloud platforms, accounting systems and even old spreadsheets.
Consider regularly reviewing:
The Australian Privacy Commissioner makes the point simply, “Organisations can’t lose personal information they don’t hold.”
Data minimisation can therefore be an important part of reducing an organisation’s exposure.
User accounts are a critical line of defence.
Organisations should use multi-factor authentication (MFA) wherever practical, particularly for email, cloud applications, administrative accounts and systems containing sensitive information.
Permissions should also reflect people’s actual responsibilities.
People shouldn’t retain access to sensitive systems simply because they once needed it. When employees change roles or leave the business, review or remove access promptly.
For organisations using Microsoft 365, this can form part of a wider identity and access management approach rather than relying on passwords alone.
Security vulnerabilities are regularly discovered in operating systems, applications and other technology.
Regular patching helps close known vulnerabilities before attackers can exploit them.
Businesses should have a clear process for identifying the devices and applications they use, applying security updates, and replacing unsupported technology.
The key is consistency. Patching shouldn’t depend on somebody remembering to run an update when they have spare time.
The OAIC figures show why cybersecurity can’t be treated purely as a technology problem.
Human error caused 62 of the 149 reported breaches in the health sector during the January to June reporting period.
Staff should know how to recognise suspicious emails, protect passwords, handle sensitive information, and report anything unusual.
Effective security awareness isn’t about turning every employee into a cybersecurity expert.
It’s about giving people enough knowledge to recognise common risks and making it easy for them to ask for help.
Backups can provide an important recovery option if systems or information become unavailable.
But simply having a backup isn’t enough.
Organisations should understand:
A backup you have never successfully restored shouldn’t automatically be assumed to work when you need it.
The OAIC’s improved breach detection highlights why visibility matters.
Security monitoring can help organisations identify unusual activity earlier, investigate what’s happening and respond accordingly.
The appropriate level of monitoring will vary depending on the organisation’s size, systems, information and risk profile.
What matters is having a way to recognise when something isn’t right, rather than relying solely on somebody noticing a problem.
The middle of a cyber incident is not the ideal time to decide who is responsible for what.
An incident response plan should establish practical steps such as:
For organisations covered by Australia’s Notifiable Data Breaches scheme, it’s also important to understand the requirements around assessing and reporting eligible data breaches.
The OAIC NDB Statistics Dashboard gives organisations a useful way to explore breach trends by cause, industry, and other factors.
No organisation can completely eliminate cyber risk. But there is a significant difference between accepting that risk exists and simply waiting for something to happen.
The latest OAIC figures give Australian businesses an opportunity to step back and ask simple questions:
Cybersecurity doesn’t always require one major project. Often, improving security starts with identifying the most important risks and making practical improvements one step at a time.
At Commuserv, we help organisations take a practical approach to cybersecurity as part of their wider technology environment.
That means looking beyond individual security products to understand how your technology, people, processes, and information work together, identify risk areas, and help you establish appropriate safeguards.
If you’re unsure where your organisation’s biggest cybersecurity risks are, talk to the Commuserv team to review your current environment and identify the practical next steps.
Under Australia’s Notifiable Data Breaches scheme, covered organisations must notify when an eligible data breach occurs. The OAIC provides guidance to help organisations assess and respond to potential breaches.
There isn’t a single solution. A good starting point includes MFA, appropriate access controls, regular software patching, reliable backups, staff security awareness, monitoring and an incident response plan. Businesses should also consider whether they need to retain all the personal information they currently hold.
Data minimisation means limiting the personal information an organisation collects and retains to what it genuinely needs. The OAIC specifically highlighted data minimisation in its latest breach statistics, noting that organisations cannot lose personal information they don’t hold.
MFA adds an additional verification step to the login process. This adds another layer of protection instead of relying on a password alone.
No. While malicious or criminal attacks led to most breaches reported to the OAIC in the first half of 2026, human error also contributed. For example, the health sector recorded 62 notifications attributed to human error during the period.
Earlier detection allows an organisation to investigate and respond sooner. The latest OAIC statistics show more than half of notified breaches were identified within 10 days, while the proportion taking more than 30 days to identify declined.
The OAIC maintains a public Notifiable Data Breach statistics dashboard that covers notifications under the NDB scheme and can be filtered by timeframe, source, response time, and industry sector.
