A Record 1,205 Data Breach Notifications: What the OAIC Figures Mean

Australian organisations reported 1,205 data breaches to the Office of the Australian Information Commissioner (OAIC) in 2025. According to the OAIC's latest Notifiable Data Breaches statistics, that is the highest total since mandatory reporting started in 2018, and 8 per cent more than 2024.

The figures that matter to small business

• Health service providers were the most affected sector, with 225 notifications.
• Legal, accounting and management services recorded 81 notifications.
• 716 of the 1,205 breaches were caused by malicious or criminal activity.

So most of these incidents were not accidents. Someone was trying to get in. And the sectors with the most sensitive client information, health, legal and accounting, are well represented.

What you have to do if it happens to you

If a breach is likely to result in serious harm, you must notify the OAIC and the people affected. Our full guide to the Notifiable Data Breaches scheme covers who is covered and the four steps. The OAIC publishes a quick reference guide to help you decide whether a breach needs to be reported. We explain the steps in plain English in our overview of the Notifiable Data Breaches scheme.

Notification is the end of a process that starts with knowing what happened. That is much easier if you have:

• an up-to-date idea of what personal information you hold and where;
• logging switched on, so you can tell what was accessed;
• a written response plan that says who decides and who calls whom.

Reducing the odds

Because most breaches in the figures were criminal, the basics matter: multi-factor authentication, prompt patching, tested backups and trained staff. These are the core of the Essential Eight.

October is a good moment to act on this. ASD's Cyber Security Action Month is asking businesses to pick one fix and finish it. If you are not sure which one, get in touch and we will help you choose.