Investigations in Australia

The OAIC received 1,205 data breach notifications in 2025, the most since the scheme began and up 8% on 1,112 the year before. 716 of them came from malicious or criminal attacks, and health was the most affected sector, with 225.

Each notification starts a clock. An organisation must take all reasonable steps to assess a suspected breach within 30 days, and the OAIC says to treat 30 days as a maximum, with steps run at the same time rather than one after another.

Finding who was affected

The hardest question after a breach is whose data was taken. MediSecure lost 6.5 TB covering about 12.9 million people, and said it could not identify the individuals because the data set was too complex. Latitude’s first estimate was about 330,000 people. The final count was about 14 million records.

About 2.5 million documents were stolen from HWL Ebsworth in 2023, and about 1 million were published. The OAIC has civil penalty proceedings under way against Medibank (9.7 million people) and Optus (about 9.5 million). Those cases are still before the court, and the claims are allegations.

Following the money

AUSTRAC’s court penalties against Westpac ($1.3 billion), the Commonwealth Bank ($700 million), Crown ($450 million) and SkyCity ($67 million) total about $2.5 billion. Westpac’s case involved more than 23 million contraventions.

Since 1 July 2026, lawyers, accountants, conveyancers, real estate agents and dealers in precious metals and stones have been reporting entities under the AML/CTF Act.

Cybercrime and scams

The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024–25, about one every six minutes. The average loss per report rose 50% for businesses, to $80,850, and 219% for large businesses, to $202,700.

Australians reported $2.18 billion in scam losses in 2025, up 7.8% on 2024, across 481,523 reports. Investment scams were the largest category, at $837.7 million.

What it means for your team

The volume grows every year, and the 30-day clock does not. Donna’s agents take in terabytes of mailboxes, file shares and ledgers, build the notification list one person at a time, trace funds across accounts and answer a regulator notice with a defensible, cited record. Your team checks every finding. Data is stored and processed in Australia, with no seat fees and usage billed per matter.

Methodology

We do not generate primary data. Every figure here comes from a regulator, a government agency, a court record or reporting of one, and is cited below.

Breach notification totals are by calendar year, using the OAIC’s restated figures. Breach sizes count different things in different cases (people, records or documents), and we name the unit beside each. Matters still before a court are described as allegations.

Sources

1. 1.
   Data breach notifications increase to all-time high in 2025 OAIC, 2026
2. 2.
   Part 4: Notifiable Data Breach (NDB) Scheme OAIC, Current
3. 3.
   Enforcement actions taken AUSTRAC, Current
4. 4.
   Federal Court makes ruling in Crown matter AUSTRAC, July 2023
5. 5.
   Federal Court makes ruling in SkyCity case AUSTRAC, June 2024
6. 6.
   AUSTRAC regulatory expectations and priorities 2025–26 AUSTRAC, 2025
7. 7.
   Annual Cyber Threat Report 2024–2025 Australian Signals Directorate, October 2025
8. 8.
   Targeting Scams 2025 National Anti-Scam Centre, March 2026
9. 9.
   MediSecure confirms 13m Australians’ data stolen in breach Information Age (ACS), 2024
10. 10.
    OAIC takes civil penalty action against Medibank OAIC, June 2024
11. 11.
    Optus sued by privacy regulator over alleged failures in 2022 cyber attack ABC News, August 2025
12. 12.
    OAIC’s action in relation to the 2023 Latitude data breach OAIC, 2026
13. 13.
    Scale of HWL Ebsworth hack revealed Australian Financial Review, September 2023