Australia Faces Surge in Data Breaches to Highest Level in 3.5 Years

The Office of the Australian Information Commissioner (OAIC) has released new statistics revealing that the first half of 2024 saw the highest number of data breach notifications in three and a half years. From January to June 2024, the OAIC report stated that it received 527 notifications of data breaches—a notable increase of 9% compared to the previous six months and the highest since the second half of 2020 in Australia.

Cybersecurity incidents continue to be the leading cause of data breaches, accounting for 38% of all reported cases.

Cyber threats such as compromised credentials, ransomware, and phishing attacks remain prevalent, highlighting the urgent need for strong cybersecurity measures. Organizations are reminded to stay vigilant and adapt their defenses as threats evolve.

Data Breaches Significant Impact on Australians 

The scale of data breaches in the first half of 2024 has been striking. While 63% of breaches affected 100 or fewer individuals, there was one incident involving a staggering 12.9 million Australians. This data breach, associated with MediSecure, represents the largest number of Australians affected by a single breach since the Notifiable Data Breaches (NDB) scheme was introduced. This incident is only the second recorded breach impacting over 10 million individuals, emphasizing the severe nature of such breaches.

Australian Privacy Commissioner Carly Kind commented on the situation: “Almost every day, my office is notified of data breaches where Australians are at likely risk of serious harm. This harm can range from an increase in scams and the risk of identity theft to emotional distress and even physical harm.”

Commissioner Kind stressed that privacy and security measures must evolve to keep pace with the growing threats to Australians’ personal information.

Main Causes and Sectors Affected

The report reveals that malicious and criminal attacks were responsible for 67% of data breaches, with 57% of these breaches classified as cybersecurity incidents. The health sector and Australian Government were the most frequently affected sectors, reporting 19% and 12% of breaches, respectively. This highlights vulnerabilities in both private and public sectors, reinforcing the need for comprehensive security strategies across all sectors.

Commissioner Kind emphasized the evolving expectations placed on organizations six years after the launch of the NDB scheme. She remarked, “The Notifiable Data Breaches scheme is now mature, and we are moving into a new era in which our expectations of entities are higher.” The recent enforcement actions against organizations like Medibank and Australian Clinical Labs underline the importance of prioritizing personal information security and complying with breach notification requirements.

Strengthening Privacy Frameworks

In response to the rising number of data breaches, the Australian Government has introduced the Privacy and Other Legislation Amendment Bill 2024. This proposed legislation aims to enhance the OAIC’s enforcement capabilities by introducing an enhanced civil penalty regime and infringement notice powers. It also seeks to clarify existing security obligations by amending Australian Privacy Principle 11 to explicitly require organizations to implement technical and organizational measures—such as data encryption, securing system access, and staff training—to address information security risks.

The OAIC has expressed support for these measures, viewing them as a critical step toward strengthening Australia’s privacy framework. However, further reforms aligned with the Government’s response to the Privacy Act Review are still needed to bolster security across the economy and improve the effectiveness of the NDB scheme.

Commissioner Kind stated, “We would like to see all Australian organizations be required to build the highest levels of security into their operations to protect Australians’ personal information to the maximum extent possible.” The OAIC’s commitment to enforcing compliance and providing guidance to organizations remains steadfast as they navigate these evolving challenges.