Australia’s privacy regulator has published its data breach statistics for January to June 2026, and the headline count barely moved. The Office of the Australian Information Commissioner (OAIC) received 667 notifiable data breach notifications in the half, up just 5 from 662 in the previous period. The real movement is in the size of breaches, not their number: breaches reported to the OAIC affecting 100,000 or more people nearly tripled. In this article, “mega breaches” means those three large bands combined. That grouping is our analysis, not a term the OAIC uses, and the “nearly triple” figure is our calculation from the OAIC bands. One band in that total is worded “Globally” by the OAIC, so the total counts breaches reported to the OAIC, not just Australian breaches.
The large bands moved while the total barely did
The three bands covering breaches reported to the OAIC that affected 100,000 or more people went from 7 in the previous period to 20 in January to June 2026. That is 2.86 times the previous figure. Total notifications rose by only 0.8 percent over the same comparison, so an article that leads with “667, up 5” understates the story.
| People affected per breach | Previous period | January–June 2026 |
|---|---|---|
| 100,000 to 250,000 | 3 | 6 |
| 500,000 to 1,000,000 | 0 | 3 |
| Over 1,000,000 | 4 | 11 |
| Combined, 100,000-plus | 7 | 20 |
The sharpest qualitative change is the middle band. Breaches affecting 500,000 to 1,000,000 people went from none at all in the previous period to 3 in this half. The smallest large band doubled, from 3 to 6. The largest band needs a caution with it. The OAIC release words it as “Globally, the number of breaches reported to us that impacted over 1,000,000 individuals also increased to 11, up from 4 in the prior period.” That wording means the 11 must not be presented as 11 breaches of Australian organisations, or as 11 million-plus Australian victims each. The release names no breach in any band, and it gives no victim total across all breaches.
Health reported more than any other sector
Health service providers made 149 notifications in the half, the largest number of any sector in the release. That is 149 of 667 notifications, or 22.3 percent, which matches the “more than one in five” framing used by trade coverage of the release. Within health, 72 notifications were malicious or criminal attacks, the largest malicious-attack number for any sector, and 62 were attributable to human error, also the largest human-error number for any sector. Together, malicious attacks and human error account for 134 of health’s 149 notifications. The sector’s problem is both attackers and its own mistakes, not one or the other.
The next sectors by notification volume were education with 85 notifications, business and professional associations with 79, and financial services and personal services with 51 each. No other sector comes close to health’s total.
What was taken, and how fast breaches were found
Malicious or criminal attacks remain the leading cause of notifiable data breaches across all sectors. Contact and identity information, including identity documents, continue to be among the most compromised types of personal information. The release gives no total count for malicious or criminal attacks across all sectors, so no all-sector malicious share can be calculated from the release alone, and this article does not estimate one.
Detection speed improved on the measures the release reports. More than half of notified breaches were identified within 10 days, and the proportion of breaches taking more than 30 days to identify has declined. The release gives no exact percentages for either measure, so neither is stated here as a precise figure.
What the commissioner said
Australian Privacy Commissioner Carly Kind said: “The continued rise in data breach notifications, particularly those affecting large numbers of Australians, highlights the importance of strong privacy and information security practices.” She also said: “It also underscores the importance of data minimisation. Organisations can’t lose personal information they don’t hold. All APP entities should review their practices to ensure they’re only collecting and retaining the minimum personal information necessary to perform their functions and activities.”
Alongside the statistics, the OAIC updated its interactive NDB Statistics Dashboard to include all notifications received through to 30 June 2026.
What this release does not show
Several things readers often assume are not in this one. It names no individual breach, company, or victim list for January to June 2026, so no older named incident should be attached to these figures. It does not name the previous reporting period by calendar months, so this article calls it only “the previous period” and does not assert it was July to December 2025. It gives no victim total across all breaches and no all-sector count of malicious attacks. The release covers Australia’s notification scheme; it does not report breaches in the United States.
What to watch next
The next OAIC half-year release will show whether the jump in large bands holds, grows, or reverses. The two numbers to compare then are the combined 100,000-plus total, currently 20 against 7, and health’s share, currently 149 of 667. If the 500,000-to-1,000,000 band stays populated after going from empty to 3, that will confirm the middle of the scale has shifted, not just its top end.
Sources
- OAIC: Large-scale data breaches on the rise, latest OAIC statistics reveal (26 October 2026)
- Cyber Daily: Stat dump — Data breaches impacting Aussies continue to rise, OAIC says (26 October 2026; figures verified via search snippet, full article paywalled)
- AJP: Healthcare data breaches hit record high (26 October 2026; verified via search snippet, full article registration-gated)
