How Common Are Data Breaches in Australia?

Data breaches affect organisations of different sizes and industries, from small professional services firms to healthcare providers and large enterprises.

The Office of the Australian Information Commissioner (OAIC) reported 1,205 data breach notifications in 2025, an increase of 8% compared with 1,112 notifications in 2024. Of the 2025 notifications, 716 involved malicious or criminal activity. Health service providers accounted for 225 notifications, representing 19% of the total.

Separately, the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) reported an average self-reported cost of $56,600 per cybercrime report for small businesses in FY2024–25.

These figures measure different things: OAIC notifications relate to the NDB scheme, while ACSC figures concern reported cybercrime. They demonstrate why businesses need both a cybersecurity strategy and a documented incident response process.

A data breach can result in:

• Exposure of customer or employee personal information.
• Financial losses, fraud or identity theft.
• Disruption to business operations.
• Regulatory investigations or notification obligations.
• Loss of customer trust and reputational damage.

Preparing in advance helps your team respond methodically instead of making critical decisions under pressure.

What Should You Do in the First Hour After a Data Breach?

The priority is to contain the breach, protect affected people, and preserve evidence. Do not wait for a complete investigation before taking reasonable steps to stop further exposure.

Use this immediate response checklist:

1. Activate your incident response process. Notify the person responsible for cybersecurity or privacy and appoint a response lead.
2. Contain the incident. Work with your IT or security provider to isolate affected devices, disable compromised accounts or restrict unauthorised access.
3. Secure compromised credentials. Reset affected passwords, revoke suspicious sessions and apply multifactor authentication where appropriate.
4. Preserve evidence. Record relevant timestamps, alerts, affected systems and actions taken. Avoid wiping devices or deleting logs before receiving appropriate technical advice.
5. Assess immediate risks. Identify whether financial information, health records, identity documents or other sensitive personal information may have been exposed.
6. Contact relevant parties. Depending on the incident, contact your IT provider, cyber insurer, legal adviser, bank or payment provider.
7. Keep an incident log. Record decisions, notifications, evidence and recovery actions.

If an affected device needs to be isolated, follow your incident response team’s advice. Do not leave a compromised device connected simply to preserve evidence. Equally, avoid powering down or wiping systems without considering the forensic implications.

If money or banking credentials are at risk, contact the relevant financial institution immediately.

What Are the Four Steps of a Data Breach Response?

The OAIC recommends four key steps for responding to data breaches: contain, assess, notify and review. The exact actions depend on the incident, the risk to individuals and the organisation’s legal obligations.

Step 1: Contain the Data Breach

Containment means stopping or limiting further unauthorised access, disclosure or loss of personal information.

Depending on the situation, you may need to:

• Disable compromised user accounts or revoke access tokens.
• Isolate affected computers or servers.
• Remove unauthorised access to cloud applications.
• Recover misdirected information where possible.
• Correct a misconfigured system that exposed customer records.
• Restrict access to affected databases or shared files.

Work with qualified technical specialists when an incident involves malware, ransomware or possible evidence of a targeted attack.

Containment alone does not establish that the breach is resolved. You still need to assess the information involved, determine the risk of harm and decide whether notification is required.

Step 2: Assess the Breach and Potential Harm

Determine what happened, what information was involved, whose information may have been affected and whether the incident could cause serious harm.

Consider:

• The types of personal information involved.
• The number of affected or potentially affected individuals.
• Whether information was accessed, copied, disclosed, altered or lost.
• Who may have obtained the information and what they could do with it.
• Whether the information was encrypted and whether the encryption key was also compromised.
• Whether prompt remedial action has reduced the likelihood of serious harm.

For example, exposure of a public business email address may carry a different level of risk from the exposure of health records, identity documents or financial account details. Assess the actual circumstances rather than assuming that every incident presents the same risk.

How long do you have to assess a suspected eligible data breach?

Organisations covered by the NDB scheme must take all reasonable steps to complete the assessment within 30 calendar days after becoming aware of the information that caused them to suspect an eligible data breach. The OAIC expects organisations to act expeditiously and complete the assessment sooner where possible.

Treat 30 days as the maximum assessment timeframe, not a waiting period.

Step 3: Notify the OAIC and Affected Individuals When Required

Under the NDB scheme, an organisation covered by the Privacy Act generally needs to notify the OAIC and affected individuals when it has reasonable grounds to believe an eligible data breach has occurred, unless an exception applies.

An eligible data breach generally involves unauthorised access to or disclosure of personal information, or loss of information in circumstances where unauthorised access or disclosure is likely, and the breach is likely to result in serious harm that remedial action has not prevented.

If notification is required, prepare the OAIC statement and notify affected individuals as soon as practicable.

Your notification should explain:

• What happened and when it was discovered.
• The kinds of personal information involved.
• What the organisation has done to contain the incident.
• What affected people can do to protect themselves.
• Where people can obtain further information and assistance.

The OAIC provides options for notifying all affected individuals, notifying only those at risk of serious harm when they can be identified, or publishing a statement and taking reasonable steps to publicise it when direct notification is not practicable.

Use clear, accurate language. Do not speculate about facts that have not been established, and do not delay necessary protective communication simply because every technical detail is not yet known.

Step 4: Review the Incident and Prevent Recurrence

Once the immediate response is under control, investigate the root cause and determine which improvements are needed.

Review:

• How the breach occurred.
• Whether existing security controls worked as intended.
• Whether access permissions were appropriate.
• Whether staff training or procedures need improvement.
• Whether backups and recovery processes are reliable.
• Whether incident response and notification procedures were effective.

Document the lessons learned, assign corrective actions, and establish deadlines for completing them.

A post-incident review should produce practical changes, not just a report. For example, if a compromised account had excessive permissions, reduce those permissions and review access controls across similar accounts.

Does Every Data Breach Need to Be Reported in Australia?

No. Not every data breach requires notification under the NDB scheme. The reporting obligation depends on whether the organisation is covered by the Privacy Act and whether the incident meets the legal criteria for an eligible data breach.

The assessment should consider the likelihood of serious harm and whether remedial action has prevented that harm.

Does the Privacy Act Apply to Small Businesses?

Many Australian businesses with an annual turnover of $3 million or less may fall within the Privacy Act’s small business exemption. However, there are important exceptions.

For example, private-sector health service providers and certain other organisations may be covered regardless of turnover. Other exceptions and specific obligations can also apply.

Privacy law and related reforms can change, so do not assume that a business is exempt solely because its turnover is below $3 million. Check the current requirements with the OAIC or a qualified privacy lawyer.

If your business is covered by the NDB scheme, follow the applicable assessment and notification requirements. Even when notification under the scheme is not mandatory, other contractual, regulatory or state and territory obligations may apply. Voluntary notification may also be appropriate when it helps protect affected people.

How Do You Notify the OAIC and Affected Customers?

If you determine that an eligible data breach has occurred, prepare the required statement and notify the OAIC and affected individuals as soon as practicable.

The notification should be factual, understandable and useful.

A practical customer notification should cover:

1. What happened: Describe the incident using confirmed information.
2. What information was involved: Identify the relevant categories of personal information.
3. What the business has done: Explain containment and protective actions already taken.
4. What customers should do: Provide relevant steps, such as changing affected passwords, contacting a bank or monitoring for suspicious activity.
5. Where to get help: Give customers a contact point and relevant support resources.

For example, if a breach exposed login credentials, advise affected users to change their passwords and avoid reusing the compromised password elsewhere. If financial or identity information was exposed, consider the appropriate guidance from financial institutions and identity support services.

Do not publish unverified claims about the attacker, the number of affected individuals or the full extent of the breach.

For official guidance, consult the OAIC’s data breach response guide.

What Should You Do If Criminals Demand a Ransom?

If a ransomware attack involves a ransom demand, do not make a rushed payment decision. Contact your IT or incident response provider, legal adviser and cyber insurer as appropriate.

Paying a ransom does not guarantee that you will recover your data or prevent further extortion. Attackers may retain copies of stolen information, demand additional payments or target the organisation again.

Focus on containing the incident, preserving evidence, determining what information was affected and recovering from clean backups where possible.

Is Ransomware Payment Reporting Mandatory in Australia?

Under Australia’s Cyber Security Act 2024, certain reporting business entities must report a ransomware or cyber extortion payment within 72 hours of making the payment or becoming aware that another party made it on their behalf.

The reporting regime generally covers businesses operating in Australia with annual turnover exceeding $3 million in the previous financial year, as well as certain entities responsible for covered critical infrastructure assets. Specific eligibility rules apply.

This is a separate obligation from notifying the OAIC about an eligible data breach. A ransomware payment report does not replace any applicable privacy notification requirements.

For current requirements, use the Australian Government’s ransomware payment and cyber extortion reporting guidance.

Who Should You Contact After a Data Breach?

The right contacts depend on the type and severity of the incident.

• IT or cybersecurity provider: Contain the incident, investigate affected systems and coordinate technical recovery.
• Cyber insurer: Check your policy’s incident notification requirements and approved response providers.
• Privacy lawyer: Assess legal obligations, notification decisions and regulatory risks.
• Bank or payment provider: Secure affected accounts and payment arrangements.
• OAIC: Follow the applicable Notifiable Data Breaches reporting process.
• ReportCyber: Report relevant cybercrime or cybersecurity incidents through the Australian Government’s reporting service.
• IDCARE: Direct affected individuals to appropriate identity and cyber support where relevant.

Use the official Australian Government cyber incident reporting portal to identify the appropriate reporting option.

IDCARE is an Australian and New Zealand identity and cyber support service. Its current contact details and available assistance can be checked at IDCARE.

Keep a record of who was contacted, when the contact occurred and any instructions received.

How Can Australian Businesses Prevent Another Data Breach?

No security measure eliminates every risk, but a combination of technical controls, staff awareness and tested response procedures can reduce the likelihood and impact of future incidents.

Use Multifactor Authentication

Enable multifactor authentication on email, remote access, administrator accounts and other important systems. Review account permissions and remove access that is no longer needed.

Keep Software and Devices Updated

Apply security patches to operating systems, applications, network equipment and internet-facing services. Prioritise vulnerabilities according to their severity and exposure.

Train Employees to Recognise Phishing

Provide regular training on suspicious links, unexpected attachments, payment redirection requests and safe handling of personal information.

Protect and Test Backups

Maintain secure backup copies with appropriate access restrictions. Test restoration regularly to confirm that critical data can be recovered.

Monitor Systems and Access

Use appropriate logging, endpoint protection and monitoring to identify suspicious activity. Establish a clear escalation process for alerts that may indicate a breach.

Prepare a Written Incident Response Plan

Document the people responsible for responding, the systems to prioritise, the steps for containing an incident and the process for deciding whether notification is required.

Review and test the plan regularly, especially after major changes to your technology or business operations.

For additional preparation, read LucidByte’s backup and disaster recovery services and explore its managed IT services.

Need Help Preparing for or Responding to a Data Breach?

A well-prepared response can help reduce disruption, protect affected people and support a more controlled recovery.

LucidByte helps Australian businesses strengthen their IT environments through managed IT services, cybersecurity support and backup management.

If your business needs help reviewing its current protections or preparing an incident response process, contact LucidByte for an IT assessment.