The scale of data breaches affecting Australians grew sharply in the first half of 2026, with the privacy regulator recording a surge in incidents that compromised the personal information of hundreds of thousands of people at a time.
The Office of the Australian Information Commissioner (OAIC) received 667 notifiable data breach (NDB) notifications between January and June 2026, up slightly from 662 in the previous period. The overall count, however, understates a more significant shift: individual breaches are getting bigger.
Incidents affecting between 100,000 and 250,000 individuals doubled from three to six. Breaches impacting between 500,000 and one million people rose from zero to three. Globally, breaches reported to the OAIC that affected more than one million individuals climbed to 11, up from four in the prior period.
Read more: Australia records highest-ever breach notifications as costs keep rising
The sectors reporting the most breaches are among those brokers insure most frequently.
Health service providers topped the list with 149 notifications, 72 of which were attributed to malicious or criminal attacks and 62 to human error. Education followed with 85, business and professional associations with 79, and financial services and personal services each recording 51.
Malicious or criminal attacks remained the leading cause of breaches overall. Contact information and identity documents, including passports and driver licences, continued to be the most commonly compromised data types.
Read more: Patient records exposed as GP network breach reaches dark web
Australian Privacy Commissioner Carly Kind said the findings underscored the need for organisations to review how much personal information they collect and hold.
“The continued rise in data breach notifications, particularly those affecting large numbers of Australians, highlights the importance of strong privacy and information security practices,” Kind said.
She added: “It also underscores the importance of data minimisation. Organisations can’t lose personal information they don’t hold. All APP entities should review their practices to ensure they’re only collecting and retaining the minimum personal information necessary to perform their functions and activities.”
That message now carries financial consequences. In October 2025, the Federal Court ordered Australian Clinical Labs to pay $5.8 million after a cyberattack on its Medlab Pathology business exposed the personal information of roughly 223,000 Australians, according to law firm Gadens. It was the first civil penalty under the Privacy Act, according to Corrs Chambers Westgarth.
Under amendments passed in late 2024, the maximum penalty for serious privacy interferences by a body corporate now sits at $50 million, three times the benefit obtained, or 30% of annual turnover, whichever is greatest.
The OAIC reported that more than half of notified breaches were identified within 10 days, while the proportion taking more than 30 days to identify declined compared with the previous period.
“Timely detection and response are critical to minimising the harm caused by data breaches. It is encouraging to see improvements in how quickly organisations are identifying incidents, although prevention must remain the priority,” Kind said.
The breach data arrives as supply chain risk continues to test organisations’ defences. MinterEllison’s 2026 Perspectives on Cyber Risk report found that 57% of surveyed organisations had experienced a cyber incident through a supplier or vendor.
For brokers, that finding raises questions about whether clients’ policies extend to incidents originating in third-party systems, and whether vendor contracts include adequate notification provisions.
Australian Prudential Regulation Authority (APRA) data published in May 2026 showed that cyber gross written premium has never exceeded $73 million in a single quarter and accounts for less than 0.2% of total industry premium.
Jeffrey Gonlin, chief underwriter at Emergence Insurance, described the gap between exposure and uptake as “a real mystery.”
Gerry Power, general manager of Cowbell in Australia, pointed to perception as a factor: “Many SMEs still believe they are too small to be targeted, despite the reality that cyber criminals often view smaller businesses as easier targets.”
The combination of escalating breach severity, growing regulatory penalties, and persistently low penetration gives brokers sector-specific data to bring into renewal and new business conversations, particularly with clients in health, education, and financial services.
The OAIC has updated its interactive NDB Statistics Dashboard to include all notifications received through to June 30, 2026.
