1,205 Data Breaches: What Australia’s Worst Year on Record Tells You

The Office of the Australian Information Commissioner received 1,205 data breach notifications in the 2025 calendar year. That is the highest number since the notifiable data breach scheme commenced in 2018, and an 8% increase on 2024’s 1,112. The figure was published on 6 July 2026, and it will be quoted in a lot of vendor emails over the next few months, usually attached to a product.

I want to point at a different number, because after years of auditing information security management systems I think it is the one that should worry you.

The 489 breaches nobody is talking about

Of the 1,205 breaches notified in 2025, the OAIC attributes 716 to malicious or criminal activity. That is the majority, and it is the part that gets the headlines: hackers, ransomware, criminals.

Do the subtraction. 489 breaches, roughly four in every ten, were not attacks.

That is the part of the problem you cannot buy your way out of. No firewall stops an employee sending a spreadsheet of client records to the wrong email address. No endpoint agent catches a misconfigured folder, an ex-staff member whose access was never revoked, a laptop left in a taxi, or a mailing list that went out with the recipients in the To field instead of BCC. Those are not technology failures. They are process failures, and process failures are exactly what a management system exists to prevent.

This is the single most common blind spot I see. An organisation spends heavily on security tooling, passes a penetration test, and then breaches because nobody ever wrote down who is allowed to export the customer database, or checked that offboarding actually removes access. The money went to the 60% of the problem. The 40% got a poster in the tea room.

Who is being hit

The OAIC’s sector breakdown for 2025:

• Health service providers: 225 notifications (19% of the total). The most affected sector, by a distance.
• Financial services: 157.
• Australian Government: 118.
• Business and professional associations: 103.
• Education: 81.
• Legal, accounting and management services: 81.

Look at the bottom half of that list rather than the top. Business and professional associations. Education providers. Accounting and law firms. These are not banks with a security operations centre. Many are organisations of twenty or fifty people holding data that is wildly disproportionate to their size: member registers, student records, client financials, health information. They are attractive precisely because the data is valuable and the defences are thin.

If you are a professional services firm reading this and thinking you are too small to be interesting, 81 legal, accounting and management services firms notified the regulator last year. They thought so too.

What the OAIC’s new checklist quietly tells you

Alongside the statistics, the OAIC published a new quick reference guide for responding to data breaches for entities with obligations under the NDB scheme. It is a practical tool that walks you through whether an assessment is required, whether you need to notify the OAIC and affected individuals, and how to do it. It is available as an interactive webpage and as a downloadable self-assessment checklist.

Read that as an auditor would. Regulators do not publish decision-support checklists because everyone is getting the decision right. The Privacy Commissioner said the guide gives entities “quick access to essential information needed to act effectively when faced with a potential data breach, when they may be under significant pressure.” That is the regulator telling you, politely, that organisations are trying to work out their legal obligations during the incident. At two in the morning, with lawyers on the phone and the board asking questions.

That is the worst possible moment to be reading a guidance note for the first time. The decision about whether a breach is likely to result in serious harm, who makes that call, how quickly, and who signs off on notifying: all of that should be written down, agreed, and rehearsed before anything happens. In an ISO 27001 system it is not optional. Incident management is a required part of the framework, and an auditor will ask you to produce the procedure and then ask you to show evidence you have actually tested it.

I have sat in rooms where the honest answer was “we’d probably call our IT provider.” That is not a plan. That is a phone number.

This is now a commercial problem, not just a compliance one

The OAIC’s 2026 Australian Community Attitudes to Privacy Survey found that data breaches are the top perceived privacy risk for Australians, with 82% concerned, up from 74% in 2023.

Eight in ten of your customers are worried about this. That number has moved eight points in three years. It is why security questionnaires now turn up in tenders that have nothing to do with technology, and why “are you ISO 27001 certified?” has quietly become a qualifying question rather than a nice-to-have. Certification is not the point. Being able to answer the question credibly is the point, and certification happens to be the only answer that does not rely on your customer taking your word for it.

What an ISMS changes

An ISO 27001 information security management system is not a firewall and it will not stop a determined attacker on its own. What it does is close the gap those 489 non-malicious breaches live in. Specifically:

• Someone owns the data. Every information asset has a named owner who decides who may access it. Most breaches by human error trace back to nobody being clearly responsible for the thing that leaked.
• Access is granted and, crucially, removed. Joiners, movers, leavers: a process, with records. This is dull, it is where a lot of breaches start, and it is the first thing I test.
• The incident procedure exists before the incident. Who assesses, who decides whether serious harm is likely, who notifies, in what timeframe. Written, approved, and tested. Not improvised.
• Suppliers are in scope. A large share of breaches arrive through a third party. If your bookkeeper, your CRM or your outsourced IT provider is the weak point, it is still your notification to make.
• Someone independent checks it. The internal audit requirement means the system gets tested by somebody who did not build it, which is the only way you find out it does not work before an attacker does.

What I would do this week

1. Answer one question honestly: if a staff member emailed a client list to the wrong recipient this afternoon, who decides whether you notify the OAIC, and how long would that take? If you cannot name the person, you have found your first gap.
2. Download the OAIC’s self-assessment checklist and walk it through against a realistic scenario before you need it.
3. Check your offboarding. Pick the last three people who left and confirm their access is actually gone: email, file shares, SaaS tools, the shared password vault. In my experience at least one of those three will still have something.
4. Find out where you stand with a gap analysis against ISO 27001, rather than guessing.

Frequently asked questions

How many data breaches were reported in Australia in 2025?

The OAIC received 1,205 notifications in the 2025 calendar year. That is the highest since the notifiable data breach scheme began in 2018, and an 8% increase on 2024 (1,112 notifications).

What causes most data breaches in Australia?

Malicious or criminal activity accounted for 716 of the 1,205 breaches notified in 2025. That leaves 489, around 40%, arising from other causes, which is where human error and process failure sit. Both halves need addressing; most organisations only fund the first.

Which industry has the most data breaches in Australia?

Health service providers, with 225 notifications in 2025, or 19% of the national total. Financial services (157), the Australian Government (118), business and professional associations (103), education (81) and legal, accounting and management services (81) round out the top sectors.

Does ISO 27001 certification prevent data breaches?

No certificate prevents a breach, and anyone who tells you otherwise is selling something. What ISO 27001 does is force you to know what data you hold, who can reach it, what you would do if it leaked, and whether any of that is actually working. It also makes an independent auditor check. That materially reduces both the likelihood of a breach and the damage when one happens.

We’re a small business. Does the NDB scheme apply to us?

Entities covered by the Privacy Act must notify any breach likely to result in serious harm. Health service providers are covered regardless of turnover, which is part of why they top the list. If you are unsure whether you are caught, that is itself worth resolving now rather than during an incident. Start with the OAIC’s guidance and take advice.

Related reading

• ISO 27001 certification in Australia: what the process actually involves.
• Cyber and information security advisory: if you need the thinking without a full certification project.
• ISO mentoring: if you have capable people in-house and want to build the system yourselves with expert guidance.

Speak with an experienced ISO 27001 auditor

If the 489 number made you uncomfortable, that is the correct reaction. The good news is that the process side is the cheapest part of information security to fix. It costs discipline rather than licences. Start with a gap analysis and you will know exactly where you stand within a couple of weeks, with no commitment to go further.

Email hello@streamline.business or call us. You will deal directly with an experienced ISO auditor, not a salesperson.

• Brisbane 07 3667 8280
• Sydney 02 8315 7780
• Melbourne 03 9034 3990

Source: OAIC, “Data breach notifications increase to all-time high in 2025, new NDB stats show”, 6 July 2026. All figures in this article are the OAIC’s; the 489 figure is 1,205 minus the 716 breaches the OAIC attributes to malicious or criminal activity.