The Office of the Australian Information Commissioner (OAIC) published its Notifiable Data Breaches (NDB) statistics for January to June 2026 on 26 October 2026.

The OAIC says it received 667 notifications in the period, a minor increase over the 662 received in the previous reporting period.

The OAIC says breaches impacting between 100,000 and 250,000 individuals doubled from 3 to 6, breaches affecting between 500,000 and 1,000,000 individuals rose from zero to 3, and, globally, breaches reported to it that impacted over 1,000,000 individuals increased to 11, up from 4 in the prior period.

According to the OAIC, malicious or criminal attacks remain the leading cause of notifiable data breaches, and contact and identity information, including identity documents, continues to be among the most compromised types of personal information.

The OAIC says health service providers were a frequent target with 149 notifications, accounting for the largest number of malicious or criminal attacks (72 notifications) and the largest number of breaches attributable to human error (62 notifications); education (85), business and professional associations (79), and financial services and personal services (51 each) made up the rest of the top 5 sectors by volume.

The OAIC says more than half of notified breaches were identified within 10 days and the proportion taking more than 30 days to identify has declined.

Australian Privacy Commissioner Carly Kind said the continued rise in notifications also underscores the importance of data minimisation: “Organisations can’t lose personal information they don’t hold.”

The OAIC says it has updated its interactive NDB Statistics Dashboard to include all notifications received through to 30 June 2026. (source: OAIC)