Adaca analysis of OAIC breach notifications since 2022: Australian Government agencies are the third-largest source and by far the slowest to detect and report, with only 7% notified within ten days
Australian software and staffing firm Adaca published a report (dated September 2026) analysing 4,769 notifiable data breach (NDB) notifications lodged with the Office of the Australian Information Commissioner (OAIC) from 2022 to 2 July 2026, using figures it obtained from the OAIC through two freedom-of-information releases plus public data. ACS Information Age reported the findings on 13 October 2026. Notifications rose from 884 in 2022 and 893 in 2023 to 1,108 in 2024 and 1,205 in 2025; the first half of 2026 was 69% above the first half of 2022. Australian Government notifications grew from 37 in 2022 to 118 in 2025 (peaking at 161 in 2024), making government the third most-breached category at 399 notifications, behind health and finance. Government was also the slowest: since 2022 only 7.0% of its breaches were reported to the OAIC within ten days of discovery, against 34.1% for non-government entities, and 56.9% took more than 30 days. 60.0% of government breaches took more than a month just to identify, against 20.5% elsewhere. Information Age reported that agencies averaged 108 days to notify. Across all sectors, 2026 is the best year on record so far: 38.4% of breaches were notified within ten days and 18.6% took more than 30 days, against 28.0% within ten days across 2022 and 2023. Hacking rose from 2.4 to 7.0 notifications a month, while ransomware's share of cyber incidents fell. Information Age also noted that the OAIC's NDB statistics dashboard has not been updated since its first-half-2025 data; the OAIC said an update is in progress. The figures are a private firm's analysis of FOI data, not official OAIC statistics. Under the Privacy Act an entity that suspects an eligible data breach has 30 days to assess it and must then notify as soon as practicable. Primary: Adaca report; ACS Information Age.
- Product
- Notifiable Data Breaches scheme (Privacy Act 1988) — reporting timeliness by sector
- Versions
- n/a — research on regulator data; not a product CVE
- Exploited in Australia?
- unknown
- Patch to
- Agencies and businesses: time-stamp discovery, assessment and notification for every suspected breach; aim to finish the assessment well inside the 30-day limit and notify the OAIC and affected people as soon as practicable; rehearse the decision path (who calls it an eligible data breach) before an incident; check detection coverage on legacy and third-party systems, where slow discovery drives the delays.
Primary: Adaca — Breach reporting in the AI era: 4,769 OAIC data breach notifications, 2022 to present (report, September 2026) · Vendor: OAIC — Notifiable data breaches publications and statistics · ACS Information Age — Govt agencies taking three months to report data breaches (13 Oct 2026)