Data breach notifications increase to all-time high in 2025, new NDB stats show

The OAIC published new Notifiable Data Breaches scheme statistics on 6 July 2026 showing that 1,205 data breach notifications were received in the 2025 calendar year, the highest number since the mandatory reporting scheme commenced in 2018 and an 8 per cent increase on the 1,112 notifications received in 2024. Entities covered by the Privacy Act are required to notify the OAIC and affected individuals of any data breach likely to result in serious harm.

Malicious or criminal attacks remained the primary cause of breaches, accounting for 716 of the 1,205 notifications for the year. Health service providers were the most commonly affected sector, accounting for 225 notifications or 19 per cent of the total, followed by financial services with 157 notifications, the Australian Government with 118, business and professional associations with 103, and education and legal, accounting and management services with 81 notifications each. Later published data for the July to December 2025 period showed social engineering and other cyber incidents remained prominent, alongside a substantial share attributable to human error.

In response to the rising volume of notifications, the OAIC published a new quick reference guide to help entities determine whether an assessment is required, whether to notify the OAIC and affected individuals, and how to do so, available both as an interactive webpage and a downloadable checklist. Every entity covered by the Privacy Act, including law practices handling client and personal information, should expect continued regulatory attention to how quickly breaches are detected, contained and assessed against the 30 day timeframe for determining whether notification is required.