Data in danger: The Aussie industries most at risk of a breach

• Health service providers lodged 149 of the 667 data breach notifications received between January and June, according to the Office of the Australian Information Commissioner.
• Education ranked second with 85 notifications, while 66 of the 79 breaches at business and professional associations came from criminal attacks.
• Breaches affecting between 500,000 and 1,000,000 individuals rose from zero to three.

Australia’s health providers remain the favourite target for data thieves as businesses report a wave of data breach attempts.

The Office of the Australian Information Commissioner’s (OAIC) released its latest Notifiable Data Breaches (NDB) statistics, showing that health service providers lodged 149 of the 667 breach notifications received between January and June 2026, more than any other sector.

Of those, 72 came from malicious or criminal attacks, including 21 phishing scams, and 62 from human error, the most of any industry on both counts.

Education ranked second with 85 notifications, already more than the 81 the sector reported across the whole of 2025.

The figures show the organisations that Australians trust with their contact details and identity documents are now the most exposed, just as breaches big enough to hit hundreds of thousands of people at once become more common.

Under the NDB scheme, businesses and Commonwealth government agencies covered by the Privacy Act must report any breach likely to cause serious harm to the people affected.

The rising number of breaches, particularly those affecting large numbers of Australians, “highlights the importance of strong privacy and information security practices,” Australian Privacy Commissioner Carly Kind said, noting that “organisations can’t lose personal information they don’t hold.”

She urged all organisations covered by the Australian Privacy Principles (APP) to review their practices and ensure they are “only collecting and retaining the minimum personal information necessary to perform their functions and activities.”

Business and professional associations ranked third with 79 notifications but had the highest share caused by criminals, with 66 of their breaches, or 84 per cent, coming from malicious attacks, according to the OAIC’s NDB statistics dashboard.

Subscribe here for our FREE Tuesday and Thursday newsletter

Email address

Subscribe

Education suffered the most hacking and ransomware of the top five sectors, with 15 hacking incidents and 11 ransomware attacks among its 53 malicious breaches.

Financial services and personal services, which include employment services, child care and vets, tied for fourth with 51 notifications each.

Across all sectors, malicious or criminal attacks caused 414 breaches, up from 398 in the July to December 2025 period, while breaches caused by human error fell from 194 to 178.

Total notifications rose only slightly from 662, but breaches affecting between 100,000 and 250,000 individuals doubled from three to six, and those affecting between 500,000 and 1,000,000 individuals rose from zero to three.

More than half of the notified breaches were identified within 10 days, which Kind said was encouraging, “although prevention must remain the priority.”

The figures follow a record 2025, when the OAIC received 1,205 notifications, the most since the scheme began in 2018, according to its full-year figures.