Data breaches affecting more than one million individuals nearly tripled in the first half of 2026, according to the latest statistics from the Office of the Australian Information Commissioner (OAIC).
The OAIC received 667 notifications under the Notifiable Data Breach (NDB) scheme between January and June 2026, up from 662 in the previous period. But the overall count masks a shift in scale. Breaches impacting between 100,000 and 250,000 individuals doubled from 3 to 6, those affecting between 500,000 and 1,000,000 individuals rose from zero to 3, and breaches reported to the OAIC that impacted more than 1,000,000 individuals globally increased to 11, up from 4 in the prior period.
The pattern is part of a sustained upward trend. The OAIC recorded 893 notifications across 2023, a then-record 1,113 in 2024, and 1,205 in 2025, which the OAIC described as an all-time high since the NDB scheme began in 2018.
For brokers, the growing scale of individual breaches carries direct commercial implications. Notification costs, credit monitoring, and forensic investigation expenses scale with the number of affected individuals, and a single incident affecting hundreds of thousands of records can quickly test the adequacy of policy sub-limits.
Read more: Privacy Act shake-up: Why brokers can no longer treat cyber as a standalone risk
Health service providers accounted for the largest share of notifications at 149. The sector led for both malicious or criminal attacks (72 notifications) and human error (62 notifications).
Education followed with 85 notifications, business and professional associations with 79, and financial services and personal services each recorded 51.
The health sector’s position at the top of both categories creates compounding exposure. Clients in this space hold sensitive identity documents alongside medical records, and policies need to respond to criminal intrusions and staff-related incidents alike.
IBM’s 2026 Cost of a Data Breach report, conducted by the Ponemon Institute and reported by IT Brief Australia, found that the average cost of a data breach for an Australian organisation reached AU$4.22 million. Healthcare breaches averaged AU$5.09 million. Breaches that took more than 200 days to contain cost an average of AU$5.17 million, compared to AU$3.26 million for those resolved within 200 days.
Malicious or criminal attacks continued to be the primary driver of notifiable data breaches. Contact and identity information, including identity documents, were among the most compromised types of personal information.
Australian Privacy Commissioner Carly Kind said the figures reinforced the need for organisations to protect personal information proactively. “The continued rise in data breach notifications, particularly those affecting large numbers of Australians, highlights the importance of strong privacy and information security practices,” Kind said.
She added: “It also underscores the importance of data minimisation. Organisations can’t lose personal information they don’t hold. All APP entities should review their practices to ensure they’re only collecting and retaining the minimum personal information necessary to perform their functions and activities.”
Data minimisation is becoming an underwriting consideration. Insurers are increasingly looking at how much data an applicant collects and retains when assessing risk, and brokers who advise clients to reduce their data footprint may help position them for improved terms.
The Insurance Council of Australia (ICA) noted in a February 2026 submission to the Parliamentary Joint Committee on Corporations and Financial Services that cyber insurance take-up among small businesses “is understood to be low.”
Trent Nihill, general manager of Coalition Australia, pointed to the quoting process as a barrier. “The challenge often is not necessarily the price of selling it, it’s actually getting the quote in the first place. It’s on cyber insurers to ask the questions better, or when the questions aren’t required, don’t ask them at all,” Nihill said.
The Australian Signals Directorate’s (ASD) Annual Cyber Threat Report 2024-25 put the average cost of cybercrime for large Australian businesses at approximately AU$202,700 per incident, a 219% year-on-year increase.
Read more: Australian healthcare faces sustained cyber threats to critical systems
The OAIC statistics showed that more than half of notified breaches were identified within 10 days, while the proportion taking more than 30 days to identify declined.
“Timely detection and response are critical to minimising the harm caused by data breaches. It is encouraging to see improvements in how quickly organisations are identifying incidents, although prevention must remain the priority,” Kind said.
Those improvements arrive alongside a tightening regulatory environment. Amendments to the Privacy Act introduced a statutory tort for serious invasions of privacy, which commenced on June 10, 2025. The Australian Prudential Regulation Authority’s (APRA) Prudential Standard CPS 230 on operational risk management took effect on July 1, 2025.
In February 2026, the Federal Court ordered FIIG Securities to pay $2.5 million in penalties following Australian Securities and Investments Commission (ASIC) proceedings over cyber security failures spanning more than four years.
For brokers, the combination of larger incidents, low SME take-up, new statutory liabilities, and active enforcement means reviewing policy limits, sub-limits for notification and response costs, and coverage for regulatory defence should be a standard part of renewal discussions.
The OAIC has updated its interactive NDB Statistics Dashboard to include all notifications received through to June 30, 2026.
