TL;DR: The OAIC received 1,205 notifiable data breach reports in 2025, the most since the scheme started in 2018 and up 8% from 1,112 in 2024. Malicious or criminal activity caused 716. Health service providers were the most affected sector (225, 19%), followed by finance (157) and the Australian Government (118). And 82% of Australians now say they’re concerned about breaches. Released 6 July 2026.
The headline numbers
From the OAIC’s July 2026 release:
| Metric | 2025 |
|---|---|
| Total notifications | 1,205 (record) |
| Change vs 2024 | +8% (from 1,112) |
| Caused by malicious or criminal activity | 716 |
| Australians concerned about breaches | 82% (up from 74% in 2023) |
That’s about 23 breaches a week serious enough to report, or roughly five every working day.
Which sectors leak the most
| Sector | Notifications |
|---|---|
| Health service providers | 225 (19%) |
| Financial services | 157 |
| Australian Government | 118 |
| Business and professional associations | 103 |
| Education | 81 |
| Legal, accounting and management | 81 |
Health tops the list again. That fits the big health breaches of recent years: MediSecure, Medibank and Genea.
What the Commissioner said
Privacy Commissioner Carly Kind described the threat as "substantial and rising year on year."
What a "notifiable" breach means
Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify you and the OAIC when a breach is likely to cause serious harm. So these 1,205 are the serious ones, not every lost laptop.
What it means for you
- Assume your data is out there. With this volume, it’s a matter of how much, not whether.
- Health and finance data is most at risk, which is also the data scammers can use most convincingly.
- Most breaches are deliberate attacks, so the stolen data is usually going somewhere useful to criminals.
What to do
- Check your email with our free exposure checker.
- Use unique passwords and MFA everywhere it counts.
- Know your rights: complain to the OAIC if a company drops the ball.
- Consider a credit ban if your ID details have leaked.
Our list of Australia’s biggest breaches shows which ones you’re likely in.
Frequently Asked Questions
How many data breaches were reported in Australia in 2025?
1,205 notifications to the OAIC, the highest since the scheme began in 2018.
What sector had the most data breaches in Australia in 2025?
Health service providers, with 225 notifications (19% of the total).
What caused most data breaches in 2025?
Malicious or criminal activity, which caused 716 notifications.
Are data breaches increasing in Australia?
Yes. 2025 notifications were up 8% from 1,112 in 2024.