TL;DR: Australia has had a rough few years. MediSecure (12.9M), Medibank (9.7M), Optus (9.5M), Latitude (7.9M licence numbers), Qantas (5.7M), MyDeal (2.2M) and Origin Energy (900,000) are the headline breaches, and the OAIC logged a record 1,205 breach notifications in 2025. If you’re an adult Australian, you’re almost certainly in at least one. Here’s the list and what to do about it.
The big ones
| Breach | When | People | Most sensitive data | Guide |
|---|---|---|---|---|
| MediSecure | May 2024 | ~12.9M | Prescription info, Medicare card details | Details |
| Medibank | Nov 2022 | ~9.7M | Health claims data | Details |
| Optus | Sep 2022 | ~9.5M | Licence and passport numbers, addresses | Details |
| Latitude Financial | Mar 2023 | 7.9M licence numbers (AU and NZ) | Driver licence numbers | Details |
| Qantas | Jul 2025 | ~5.7M | Frequent Flyer details, some birthdates | Details |
| MyDeal (Woolworths) | Oct 2022 | ~2.2M | Contact details, some birthdates | Details |
| Origin Energy | Jul 2026 | ~900,000 | Birthdates, partial card/bank numbers | Details |
| iiNet (TPG) | Aug 2025 | ~280,000 emails | Modem passwords (1,700) | Details |
| Genea | Jan–Feb 2025 | Not disclosed | Fertility and medical records | Details |
Figures for the first seven come from a Reuters factbox; others from the linked guides.
Add those up and you get more records than there are Australians. That’s not a maths error. Most of us are in several.
The newest twist: AI agents
In September 2026, Australia said an OpenAI agent got around access blocks on a Medicare statistics portal. Officials say it held aggregated data only. See what we know.
The trend
The OAIC received 1,205 notifiable data breach reports in 2025, the highest since the scheme began in 2018, with health the most affected sector (full stats).
What jumps out
- Health data is the prize. MediSecure, Medibank and Genea all held medical information you can’t change.
- ID numbers leak in bulk. Optus and Latitude exposed millions of licence and passport numbers.
- One stolen login is enough. MyDeal and iiNet were both accessed with compromised credentials; Qantas via a call centre.
One checklist for all of them
- Check your email with our free exposure checker.
- Change reused passwords, then turn on MFA, starting with email and myGov.
- Consider a credit ban if your ID and birthday are out there (how).
- Get your free credit reports (how).
- Treat breach-themed contact as suspect. "Compensation" offers are a classic follow-up scam.
- Get help from IDCARE (1800 595 160) if your identity is misused.
Your rights
Complain to the company, then the OAIC (how). Serious privacy invasions can now also be taken to court under the statutory privacy tort.
Frequently Asked Questions
What is the biggest data breach in Australian history?
By people affected, MediSecure (about 12.9 million) is among the largest, followed by Medibank (9.7 million) and Optus (9.5 million).
How many data breaches were reported in Australia in 2025?
The OAIC received 1,205 notifications in 2025, the highest since the scheme began.
How do I know if I was in an Australian data breach?
Check notification emails and letters, and run your email through a breach checker like our free exposure check.
What should I do if I’m in several breaches?
Change reused passwords, turn on MFA, consider a credit ban and check your credit reports.
Sources
- Reuters factbox via The Star: OpenAI breach latest in long list of hacks in Australia
- OAIC: Data breach notifications at all-time high in 2025