The Australian Information Commissioner (OAIC) regularly releases statistics on data breaches reported under the Notifiable Data Breaches (NDB) scheme. This information helps organisations and the public stay informed about the privacy risks identified through the scheme. The rising number of data breaches suggests that organisations may not be conducting enough network penetration testing, cyber security audits and other regulatory compliances like PCI-DSS, ISO 27001, Essential 8. This report specifically focuses on data breaches reported from July 1st, 2023, to December 31st, 2023.
It’s important to note that comparisons in this report are typically made against data from the first half of 2023 (January 1st to June 30th) unless otherwise stated. Additionally, percentages in the charts might not perfectly add up to 100% due to rounding.
The source of each breach is based on what the reporting entity provides. If there are multiple possible sources, the report considers the most likely or dominant source. It’s important to remember that notifications made under the My Health Records Act 2012 are not included in this report, as they have their own specific reporting requirements defined by that legislation.
Finally, while the statistics in this report are current as of January 30th, 2024, some data breach notifications are still being assessed. This means that adjustments might be made to the related statistics, potentially impacting the data presented for the July to December 2023 period in future reports. Similarly, statistics from before July 2023 in this report might differ slightly from those published in previous reports.
Key findings for the July to December 2023 reporting period:
1.The number of reported breaches increased by 19 percent, rising from 407 in January to June of 2023 to a total of 483.
2. Malicious or criminal attacks remained the leading cause (67%) of data breaches.
3. The health and finance sectors remained the top reporters of data breaches. Health reported 104 breaches (22% of all notifications) and finance 49 breaches (10%).
4. The majority of breaches (65%) affected 100 or fewer people.
Besides the 483 main notifications, the OAIC got 121 extra notifications, which was a big rise from the 29 extra notices they had between January and June of 2023.
Increased focus on Ensuring Organisations Comply With the NDB Scheme
The Australian Information Commissioner (OAIC) prioritises data security and expects businesses to have effective data breach response plans. Recent determinations and legal actions highlight the importance of:
- Taking reasonable steps to protect personal information.
- Having proper data retention practices.
- Complying with data breach reporting requirements, especially when the OAIC raises concerns.
- Conducting swift assessments of suspected data breaches.
Businesses are encouraged to review the recent determinations and consider developing their own data breach response plans.
All Industry Data Breach Notifications, July-December 2023
During this time of reporting, the OAIC got 483 notifications, which is a rise of 19% if you look at it from January to June in 2023. This follows what the OAIC has been seeing since they began the NDB scheme in February of 2018; that there are usually more notifications coming in during the last part of each year.
After a usually small count of notices, being 57 in July of the year 2023, we observed a consistent growth in the number of such notices every month. It reached its highest point with 97 notifications in December of that same year.
| Reporting period |
Number of notifications |
| January to June 2023 |
407 |
| July to December 2023 |
483 |
| Total |
890 |
Chart 1: Notifications received by month from January 2022 to December 2023
Chart 2: Notifications received by month showing the sources of breaches
Number of individuals worldwide affected by breaches
During the reporting period that we are talking about, most of the data leaks (91%) involved personal details of around 5,000 people worldwide. When there were breaches that hit less than 100 persons, this was 65% of every alert made. Breaches involving between one and ten people represented 44 percent of all the reports, which is comparable to past reporting times.
Chart 3: Number of individuals worldwide affected by breaches.
Massive data breaches impacting Australians
In the second half of 2023, the OAIC received about the same number of data breaches that impacted over 5,000 Australians as it did in the first half of the year.
|
Number of Australians affected by breaches |
Jan–Jun 2023 |
Jul–Dec 2023 |
| 5,001–10,000 |
11 |
7 |
| 10,001–25,000 |
5 |
4 |
| 25,001–50,000 |
3 |
7 |
| 50,001–100,000 |
3 |
0 |
| 100,001–250,000 |
1 |
4 |
| 250,001–500,000 |
0 |
1 |
| 500,001–1,000,000 |
0 |
1 |
| 1,000,001–10,000,000 |
2 |
2 |
| 10,000,001 or more |
1 |
0 |
| Total number of breaches affecting over 5,000 Australians |
26 |
26 |
Cyber incidents kept being the main reason for data breaches that affected many people in Australia. Out of 26 big breaches impacting more than 5,000 Australians, cyber events were responsible for 22 of them. The primary reasons were credentials that got compromised or stolen, reported 9 times; ransomware issues, which had 8 reports; and hacking incidents with 4 reports.
Types of Personal Information Involved in Breaches
Contact details and personal identity were the types of private information most frequently involved in security breaches. The majority of these incidents, about 88 percent, included elements like a person’s name, residential address, telephone number, and email. This is different from identity information, that got revealed in 63% of the breaches and has details to verify someone’s identity like when they were born, passport specifics and other government identification numbers.
In this time for reporting, health information became uncovered in 41% of the data breaches, and it went past financial details to be the third most usual type of personal information involved.
Chart 4: Kinds of personal information involved in breaches.
Time required to identify breaches
Quickly detecting a data breach helps an organisation to control it fast, which cuts down the damage and shortens how long hackers can get into systems. During this report period, entities noticed 64% of breaches within ten days after they happened. Around a quarter (23%) of breaches were identified over 30 days after it occurred.
Chart 5: Time taken to identify breaches.
Depending on where the breach originated, different entities took different amounts of time to identify it. The fastest to be identified were breaches due to human error (71% found within 10 days), followed by malicious or criminal attacks (61%).
System fault breaches were the slowest to be discovered (53% within 10 days), in line with earlier reports.
Chart 6: Time taken to identify breaches by source of breach.
Time required to notify the OAIC of breaches
The numbers in this part show the period from when a company realised an incident occurred to when they informed the OAIC. This is not about how long it took for the company to decide if the incident was a significant data breach and then tell the OAIC.
In this time for reporting, 72% of organisations informed the OAIC with