-
On this page
Download the print version and read our media release
Snapshot long text description
About this report
The Office of the Australian Information Commissioner (OAIC) periodically publishes statistical information about notifications received under the Notifiable Data Breaches (NDB) scheme to help entities and the public understand privacy risks identified through the scheme. This report captures notifications made under the NDB scheme from 1 January to 30 June 2022.
Statistical comparisons are to the period 1 July to 31 December 2021 unless otherwise indicated.
Percentages in charts may not total 100% due to rounding.
Where data breaches affect multiple entities, the OAIC may receive multiple notifications relating to the same incident. Notifications relating to the same incident are counted as a single notification in this report unless otherwise specified.
The source of any given breach is based on information provided by the reporting entity. Where more than one source has been identified or is possible, the dominant or most likely source has been selected. Source of breach categories are defined in the glossary at the end of this report.
Notifications made under the My Health Records Act 2012 are not included as they are subject to specific notification requirements set out in that Act.
Statistics in this report are current as of 30 September 2022. Some data breach notifications are being assessed and adjustments may be made to related statistics. This may affect statistics for the period January to June 2022 published in future reports. Similarly, statistics from before January 2022 in this report may differ from statistics published in previous NDB reports.
Executive summary
The NDB scheme was established in February 2018 to improve consumer protection and drive better security standards for protecting personal information. Under the scheme, any organisation or government agency covered by the Privacy Act 1988 that experiences an eligible data breach must notify affected individuals and the OAIC.
The OAIC publishes twice-yearly reports on notifications received under the NDB scheme to track the leading sources of data breaches and highlight emerging issues and areas for ongoing attention by regulated entities.
Key findings for the January to June 2022 reporting period:
- 396 breaches were notified compared to 460 in July to December 2021 (14% decrease).
- Malicious or criminal attack remains the leading source of breaches accounting for 250 notifications (63% of the total), down 1% in number from 253.
- Data breaches resulting from human error accounted for 131 notifications (33% of the total), down 31% in number from 189.
- Health remains the highest reporting sector notifying 20% of breaches, followed by finance (13%).
- Contact information remains the most common type of personal information involved in breaches.
- 91% of breaches affected 5,000 individuals or fewer, while 65% affected 100 people or fewer.
- 71% of entities notified the OAIC within 30 days of becoming aware of an incident.
Notifications received January to June 2022 – All sectors
The OAIC received 396 notifications this reporting period. This is a 14% decrease compared to the previous 6 months.
There was significant variation month to month in the number of notifications received. The lowest monthly total was 47 notifications in January and the highest was 82 notifications in May. January 2021 is the only other month since the scheme began in which the OAIC received fewer than 50 notifications.
Table 1 – Notifications received in the 2021–22 financial year
Reporting period | Number of notifications |
|---|---|
July to December 2021 | 460 |
January to June 2022 | 396 |
2021–22 financial year | 856 |
Chart 1 – Notifications received by month from January 2020 to June 2022
Chart 2 – Notifications received by month showing the sources of breaches
Number of individuals affected by breaches
Consistent with previous reports, most data breaches (91%) involved the personal information of 5,000 individuals worldwide or fewer. Breaches affecting 100 individuals worldwide or fewer comprised 65% of notifications and breaches affecting between 1 and 10 individuals worldwide accounted for 46% of notifications.
Chart 3 – Number of individuals worldwide affected by breaches
These figures reflect the number of individuals worldwide whose personal information was compromised in data breaches notified to the OAIC, as estimated by the notifying entities.
Large scale data breaches
In this reporting period, there was an increase in data breaches that reportedly impacted a larger number of Australians.
There were 24 data breaches reported to affect 5,000 or more Australians, compared with 18 breaches of this scale in July to December 2021. Four of these breaches were reported to affect 100,000 or more Australians, compared with one breach in the previous reporting period.
Number of Australians affected by breaches | Jul–Dec 2021 | Jan–Jun 2022 |
|---|---|---|
5,001–10,000 | 7 | 9 |
10,001–25,000 | 5 | 5 |
25,001–50,000 | 2 | 3 |
50,001–100,000 | 3 | 3 |
100,001–250,000 | 1 | 3 |
1,000,001–10,000,000 | 0 | 1 |
Twenty-three of the 24 breaches that affected more than 5,000 Australians were caused by cyber incidents, with the remaining breach resulting from a system fault. Nine were ransomware incidents, 9 were due to compromised credentials, 3 were due to hacking and 2 were malware incidents.
This underlines the significant impact of cyber incidents on individuals in this reporting period, and the importance of entities taking appropriate protective measures against a range of cyber threats. The Australian Cyber Security Centre has useful guidance for entities on improving their cyber resilience and protecting the personal information they hold from cyber threats.
Kinds of personal information involved in breaches
Contact information, identity information and financial details continue to be the most common types of personal information involved in data breaches.
Most breaches (84%) involved contact information, such as an individual’s name, home address, phone number or email address.
This is distinct from identity information, which was exposed in 55% of breaches and includes an individual’s date of birth, passport details and driver licence details. Financial details, such as bank account and credit card numbers, were involved in 37% of breaches.
Chart 4 – Kinds of personal information involved in breaches
Data breaches may involve more than one kind of personal information.
Time taken to identify breaches
As part of complying with Australian Privacy Principle 11, entities should take reasonable steps to ensure they detect data breaches in a timely manner.
The figures in this section relate to the time between an incident occurring and the entity becoming aware of it. They do not relate to the time taken by the entity to assess whether an incident qualified as an eligible data breach.[1]
In the reporting period, 78% of breaches were identified by the entity within 30 days of it occurring, compared to 80% in July to December 2021.
Chart 5 – Time taken to identify breaches
For notifications in the ‘Unknown’ category, the entity was unable to identify the date the breach occurred.
The time it takes entities to identify breaches has varied significantly depending on the source of the breach. There was less variation in this reporting period, however a notable proportion of entities that experienced system faults (13%) did not become aware of the incident for over a year.
Chart 6 – Time taken to identify breaches by source of breach
For notifications in the ‘Unknown’ category, the entity was unable to identify the date the breach occurred.
Timely assessment of suspected eligible data breaches
Since the introduction of the NDB scheme, there have been instances of entities taking several months to complete an assessment and notify affected individuals of an eligible data breach.
Section 26WH of the Privacy Act requires entities to carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe that an eligible data breach has occurred. Entities are required to take all reasonable steps to complete this assessment within 30 days.
An entity should commence a s 26WH assessment if it experiences a data breach and is aware of anything that objectively - from the viewpoint of a reasonable person in the entity’s position - would give rise to reasonable grounds to suspect that an incident was an eligible data breach. An entity’s suspicion may be formed by reference to anything relevant to the breach and surrounding circumstances of which the entity is aware.
Scenario
An entity became aware of a ransomware attack that encrypted a number of files on its corporate network, although the entity did not initially know which files were affected. At this initial point, the entity had reasonable grounds to suspect an eligible data breach.
The entity undertook a s 26WH assessment to determine whether the breach was an eligible data breach. The entity engaged an IT consultant to undertake an assessment of the incident. The IT consultant identified the entity’s customer information had been accessed and exfiltrated, and some of this published on the dark web. Based on this assessment, the entity concluded this was an eligible data breach.
To ensure affected individuals were notified as soon as practicable, the entity notified all potentially affected individuals whose information may have been involved in the breach, including both those whose personal information was accessed and exfiltrated as well as those whose personal information was discovered on the dark web. As part of this notification, the entity specified the kinds of information involved in the breach and provided individuals with relevant recommendations about the steps they should take in response.
Time taken to notify the OAIC of breaches
A key objective of the NDB scheme is to protect individuals by enabling them to respond quickly to a data breach to mitigate the risk of harm. Delays in assessment and notification reduce the opportunities for an individual to take steps to prevent harm.
The figures in this section relate to the time between when an entity became aware of an incident and when they notified the OAIC. They do not relate to the time between when the entity determined the incident to be an eligible data breach and when they notified the OAIC.
In the reporting period, 71% of entities notified the OAIC within 30 days of becoming aware of an incident, compared to 75% in the previous period. Four entities took more than 12 months from when they became aware of an incident to notify the OAIC.
Some entities notified individuals at the same time as the OAIC or shortly after. This approach helps individuals take timely steps to protect themselves from harm. Some entities notified the OAIC and then there was a delay before they notified individuals.
Chart 7 – Time taken to notify the OAIC of breaches
For notifications in the ‘Unknown’ category, the entity was unable to advise the OAIC the date it became aware of the incident.
There was some variance by source of breach in the time taken to notify the OAIC after an incident was identified. For system fault breaches, 93% of entities notified the OAIC within 30 days compared to 79% for human error breaches and 65% for breaches caused by malicious or criminal attacks.
Chart 8 – Time taken to notify the OAIC of breaches by source of breach
For notifications in the ‘Unknown’ category, the entity was unable to advise the OAIC the date it became aware of the incident.
Website notification
Under the NDB scheme, entities covered by the Privacy Act must notify affected individuals and the OAIC of an eligible data breach as soon as practicable.
An entity can notify affected individuals of an eligible data breach by notifying the contents of a statement:
- to all affected individuals
- only to individuals who are at risk from the eligible data breach.
If neither of these options are practicable, the entity must publish a statement on its website and take reasonable steps to publicise its contents. Some ways entities may achieve this are:
- making an announcement to the media, on social media or through other channels where affected individuals are likely to engage
- ensuring the statement is prominently placed on the relevant website and can be easily located and indexed by search engines.
A key objective of the NDB scheme is to protect individuals by enabling them to respond quickly to a data breach to minimise the risk of harm. The method of communication should seek to ensure that individuals can trust and act upon the information provided.
If identifying contact details of affected individuals or preparing tailored notifications is impracticable and will cause extended delay in notifying affected individuals, it is likely that website notification will be needed. It may be that this can be followed up with notification to individuals.
Scenario
A health service provider experienced a ransomware incident that involved unauthorised access to its systems and records.
Based on a review of audit logs, the disability services provider determined 50 individuals were at risk of serious harm due to the kinds of personal information involved.
The health service provider directly notified 36 of these individuals via email or direct message on relevant social media platforms. However, it did not hold up-to-date contact information for 14 of the affected individuals. As such, rather than sourcing up-to-date contact information for those 14 individuals at that time, which may have delayed notification, the disability services provider decided to make a public statement.
The health service provider published the statement on its website, social media and print newsletter while it continued its efforts to contact the 14 individuals directly. It ensured this was likely to be accessible to the affected individuals by providing a version in Auslan.
Source of breaches
Consistent with previous reports, malicious or criminal attack was the largest source of data breaches notified to the OAIC, accounting for 250 breaches (down from 253).
Human error remained a major source of breaches, accounting for 131 notifications (down from 189).
System faults accounted for the remaining 15 breaches (down from 18).
Malicious or criminal attacks
The number of breaches attributed to a malicious or criminal attack decreased by 1%. The proportion of total breaches caused by malicious or criminal attack increased from 55% to 63%.
The majority of breaches (65%) in this category involved cyber incidents (162 notifications).
Social engineering or impersonation accounted for 58 notifications, theft of paperwork or data storage device for 17 notifications and actions taken by a rogue employee or insider threat for 13 notifications.
Cyber incidents
In this reporting period, 65% of breaches attributed to malicious or criminal attack – or 41% of all breaches (162 notifications) – resulted from cyber security incidents.
The top sources of cyber incidents were ransomware (51 notifications), phishing (42 notifications) and compromised or stolen credentials (method unknown) (40 notifications).
Just over half (54%) of cyber incidents involved malicious actors gaining access to accounts using compromised or stolen credentials.
Human error
The reporting period saw a significant decrease in human error breaches in terms of the total number of notifications – down 31% from 189 to 131 – and proportionally – down from 41% to 33% of all breaches.
Just over half (54%) of human error breaches involved personal information being sent to the wrong recipient either by email, mail, fax or another method.
Certain human error breaches affect larger numbers of individuals. In this reporting period, unintended release or publication affected an average 134 people per breach, while verbal disclosure affected one person on average per breach.
Table 2 – Human error breakdown by average number of affected individuals
Source of breach | Number of notifications | Average number of affected individuals |
|---|---|---|
Unauthorised disclosure (unintended release or publication) | 31 | 134 |
Failure to use BCC when sending email | 7 | 116 |
PI sent to wrong recipient (email) | 50 | 62 |
PI sent to wrong recipient (mail) | 11 | 48 |
Insecure disposal | 1 | 41 |
PI sent to wrong recipient (other) | 8 | 21 |
Loss of paperwork/data storage device | 8 | 19 |
Unauthorised disclosure (failure to redact) | 3 | 7 |
PI sent to wrong recipient (fax) | 2 | 3 |
Unauthorised disclosure (verbal) | 10 | 1 |
Total | 131 | 68 |
System faults
System fault breaches include incidents that occur due to a business or technology process error and accounted for 4% of all notifications. The proportion of breaches attributed to system faults has been consistent since the NDB scheme began.
Unintended release or publication of personal information due to a system fault caused 11 breaches. Unintended access to personal information because of a system fault caused 4 breaches.
Chart 13 – System fault breakdown
Data breaches involving more than one entity
Where a single data breach incident affects multiple entities, the OAIC may receive multiple notifications relating to the same incident. This is occurring more frequently.
Notifications relating to the same incident are counted as a single notification in this report to avoid information being duplicated. However, the volume of secondary notifications provides an indication of the level of multi-party breach reporting. This reporting period, the number of secondary notifications received increased by 100% compared with the previous period.
When more than one entity holds personal information that is subject to a data breach, all affected entities may have obligations under the NDB scheme. However, only one of the affected entities needs to make an assessment of the suspected eligible data breach under s 26WH of the Privacy Act and notify the OAIC and affected individuals.
A number of factors may influence which entity notifies the OAIC and affected individuals. Generally, the OAIC recommends the entity with the most direct relationship with affected individuals notifies them.
Entities should work together to ensure the requirements of the NDB scheme are met. In some instances, the entity with the most information about the data breach will not be the entity with the most direct relationship with affected individuals. It may be that the entity with the most information about the data breach is best placed to complete the assessment, and the entity (or entities) with the most direct relationship with affected individuals is best placed to notify the OAIC and affected individuals.
Each entity that holds personal information involved in an eligible data breach needs to be able to demonstrate they are meeting the requirements of the NDB scheme. Assigning the roles and responsibilities of each entity upfront will support a quick and efficient data breach response.
Scenario
A cloud service provider experienced a malware attack that involved their systems being accessed by a threat actor. The cloud service provider’s assessment identified a large volume of data may have been exfiltrated, including information stored for its client organisations.
The cloud service provider informed its client organisations, notified the OAIC and provided the OAIC with the identity and contact details of affected client organisations. It also published information about the data breach on its website.
The cloud service provider did not have a direct relationship with or knowledge of each of its client organisations’ customers (the affected individuals). For this reason, the cloud service provider gave each client organisation access to its assessment and a copy of the client organisation’s data that may have been involved in the attack. The cloud service provider asked each client organisation to notify affected individuals of the breach as required by the NDB scheme, which the client organisations proceeded to do.
Comparison of top 5 sectors
Health service providers and the finance industry have consistently reported the most data breaches of all sectors since the NDB scheme began.
Health service providers reported 79 data breaches (20% of notifications). The second largest source of notifications was the finance sector (13%).
The other sectors in the top 5 by notifications were education (9%), legal, accounting and management services (7%) and recruitment agencies (6%).
Table 3 – Top 5 sectors by notifications
Sector | Number of notifications |
|---|---|
Health service providers[2] | 79 |
Finance[3] | 52 |
Education[4] | 35 |
Legal, accounting and management services | 26 |
Recruitment agencies[5] | 25 |
Total | 217 |
This section compares notifications made under the NDB scheme by these sectors, which accounted for 55% of all notifications.
Time taken to identify breaches – Top 5 sectors
There was some variation by industry sector in the time taken by entities to identify incidents.
In the reporting period, 92% of legal, accounting and management service entities identified the incident within 30 days of it occurring. This figure was 77% for the finance sector.
Chart 14 – Time taken to identify breaches – Top 5 sectors
For notifications in the ‘Unknown’ category, the entity was unable to identify the date the breach occurred.
Time taken to notify the OAIC of breaches – Top 5 sectors
There was also some variation by industry sector in the time taken by entities to notify the OAIC of a data breach.
Ninety-two per cent of notifications from recruitment agencies were made within 30 days of the entity becoming aware of the incident. This figure was 69% for the finance sector.
Chart 15 – Time taken to notify the OAIC of breaches – Top 5 sectors
For notifications in the ‘Unknown’ category, the entity was unable to identify the date the breach occurred.
Source of breaches – Top 5 sectors
Malicious or criminal attack was the top cause of data breaches notified by the top 5 sectors. It was the source of all breaches notified by recruitment agencies, 77% of legal, accounting and management services breaches, 60% of finance sector breaches and 54% of health sector breaches.
Education was the only sector in the top 5 to notify more breaches caused by human error (64% of notifications) than malicious or criminal attack (27%).
Malicious or criminal attack breaches – Top 5 sectors
Cyber incident breaches – Top 5 sectors
Human error breaches – Top 5 sectors
System fault breaches – Top 5 sectors
Of the top 5 sectors, only 3 – health service providers, finance and education – notified data breaches resulting from a system fault.
Most system fault breaches involved the unintended release or publication of personal information, such as automated messages sent to incorrect recipients or online forms or profiles automatically linked or populated with incorrect personal information.
Glossary
Term | Definition |
|---|---|
Contact information | Information that is used to contact an individual, for example, a home address, phone number or email address |
Eligible data breach | An eligible data breach occurs when:
|
Financial details | Information relating to an individual’s finances, for example, bank account or credit card numbers |
Health information | As defined in section 6 of the Privacy Act |
Identity information | Information that is used to confirm an individual’s identity, such as a passport number, driver licence number or other government identifier |
Other sensitive information | Sensitive information, other than health information, as defined in section 6 of the Privacy Act. For example, sexual orientation, political or religious views |
Personal information (PI) | Information or an opinion about an identified individual, or an individual who is reasonably identifiable |
Sensitive information | Sensitive information is personal information that includes information or an opinion about an individual’s:
|
Tax file number | An individual’s personal reference number in the tax and superannuation systems, issued by the Australian Taxation Office |
Human error | An unintended action by an individual directly resulting in a data breach, for example inadvertent disclosure caused by sending a document containing personal information to the incorrect recipient |
Failure to use BCC when sending email | Sending an email to a group by including all recipient emails addresses in the ‘To’ field, thereby disclosing all recipient email address to all recipients |
Insecure disposal | Disposing of personal information in a manner that could lead to its unauthorised disclosure, for example, using a public rubbish bin to dispose of customer records instead of a secure document disposal bin |
Loss of paperwork/data storage device | Loss of a physical asset containing personal information, for example, leaving a folder or a laptop on a bus |
PI sent to wrong recipient (email) | Personal information sent to the wrong recipient via email, for example, as a result of a misaddressed email or having a wrong address on file |
PI sent to wrong recipient (fax) | Personal information sent to the wrong recipient via facsimile machine, for example, as a result of an incorrectly entered fax number or having a wrong fax number on file |
PI sent to wrong recipient (mail) | Personal information sent to the wrong recipient via postal mail, for example, as a result of a transcribing error or having a wrong address on file |
PI sent to wrong recipient (other) | Personal information sent to the wrong recipient via channels other than email, fax or mail, for example, delivery by hand or uploading to web portal |
Unauthorised disclosure (failure to redact) | Failure to effectively remove or de-identify personal information from a record before disclosing it |
Unauthorised disclosure (unintended release or publication) | Unauthorised disclosure of personal information in a written format, including paper documents or online |
Unauthorised disclosure (verbal) | Disclosing personal information verbally without authorisation, for example, calling it out in a waiting room |
Malicious or criminal attack | A malicious or criminal attack deliberately crafted to exploit known vulnerabilities for financial or other gain |
Brute-force attack (compromised credentials) | A typically unsophisticated and exhaustive process to determine a cryptographic key or password that proceeds by systematically trying all alternatives until it discovers the correct one |
Compromised or stolen credentials (method unknown) | Credentials are compromised or stolen by methods unknown |
Cyber incident | A cyber incident targets computer information systems, infrastructures, computer networks or personal computer devices |
Hacking (other means) | Unauthorised access to a system or network (other than by way of phishing, brute-force attack or malware), often to exploit a system’s data or manipulate its normal behaviour |
Malware | Short for ‘malicious software’. A software used to gain unauthorised access to computers, steal information and disrupt or disable networks. Types of malware include trojans, viruses and worms |
Ransomware | Malicious software that makes data or systems unusable until the victim makes a payment |
Rogue employee/ | An attack by an employee or insider acting against the interests of their employer or other entity |
Phishing (compromised credentials) | Untargeted, mass messages sent to many people asking for information, encouraging them to open a malicious attachment, or visit a fake website that will ask the user to provide information or download malicious content |
Social engineering/ impersonation | An attack that relies heavily on human interaction to manipulate people into breaking normal security procedures and best practices in order to gain access to systems, networks or physical locations |
Theft of paperwork or data storage device | Theft of paperwork or data storage device |
System fault | A business or technology process error not caused by direct human error |
Long text descriptions
Snapshot
The snapshot is an infographic with key statistics for the January to June 2022 reporting period.
The OAIC received 396 notifications, which is down 14%.
There were 47 notifications in January, 57 in February, 69 in March, 69 in April, 82 in May and 72 in June.
The top 5 sectors to notify data breaches were:
- health service providers – 79 notifications
- finance – 52 notifications
- education – 35 notifications
- legal, accounting and management services – 26 notifications
- recruitment agencies – 25 notifications.
Sixty-five per cent of data breaches affected 100 people or fewer.
The sources of data breaches were:
- malicious or criminal attack – 63%
- human error – 33%
- system fault – 4%.
Forty-one per cent of all data breaches (162 notifications) resulted from cyber security incidents.
The breakdown of cyber incidents was:
- ransomware – 31%
- phishing (compromised credentials) – 26%
- compromised or stolen credentials (method unknown) – 25%
- hacking – 9%
- malware – 6%
- brute-force attack (compromised credentials – 3%.
The top causes of human error breaches were:
- personal information emailed to the wrong recipient – 38%
- unintended release or publication – 24%
- personal information mailed to the wrong recipient – 8%.
Chart 1 – Notifications received by month from July 2020 to June 2022
Chart 1 is a line graph showing the number of notifications by month, from July 2020 to June 2022.
Month | Number of notifications |
|---|---|
July 2020 | 101 |
August 2020 | 106 |
September 2020 | 103 |
October 2020 | 77 |
November 2020 | 59 |
December 2020 | 83 |
January 2021 | 45 |
February 2021 | 83 |
March 2021 | 102 |
April 2021 | 64 |
May 2021 | 78 |
June 2021 | 66 |
July 2021 | 76 |
August 2021 | 75 |
September 2021 | 81 |
October 2021 | 67 |
November 2021 | 81 |
December 2021 | 80 |
January 2022 | 47 |
February 2022 | 57 |
March 2022 | 69 |
April 2022 | 69 |
May 2022 | 82 |
June 2022 | 72 |
Chart 2 – Notifications received by month showing the sources of breaches
Chart 2 is a stacked column chart showing the number of notifications by month, from January to June 2022. Each column is broken down by malicious or criminal attack, human error and system fault, but figures are not specified for each category.
Month | Number of notifications |
|---|---|
January 2022 | 47 |
February 2022 | 57 |
March 2022 | 69 |
April 2022 | 69 |
May 2022 | 82 |
June 2022 | 72 |
Chart 3 – Number of individuals affected by breaches
Chart 3 is a bar chart showing the number of individuals worldwide whose personal information was compromised in data breaches, as estimated by the notifying entities.
The table is displayed from smallest to largest number of affected individuals.
Number of affected individuals | Number of notifications |
|---|---|
1 | 111 |
2 to 10 | 70 |
11 to 100 | 75 |
101 to 1,000 | 67 |
1,001 to 5,000 | 39 |
5,001 to 10,000 | 11 |
10,001 to 25,000 | 5 |
25,001 to 50,000 | 3 |
50,001 to 100,000 | 1 |
100,001 to 250,000 | 4 |
500,001 to 1,000,000 | 3 |
1,000,001 to 10,000,000 | 4 |
Unknown | 3 |
Chart 4 – Kinds of personal information involved in breaches
Chart 4 is a bar chart showing the number of notifications for each kind of personal information involved in data breaches.
Data breaches may involve more than one kind of personal information.
The table is displayed from most to least notifications.
Kind of personal information | Number of notifications |
|---|---|
Contact information | 331 |
Identity information | 217 |
Financial details | 148 |
Health information | 131 |
Tax file numbers | 76 |
Other sensitive information | 72 |
Chart 5 – Time taken to identify breaches
Chart 5 is a column chart showing the time taken by entities to identify breaches.
The table is displayed from least to most time taken to identify breaches.
For notifications in the ‘Unknown’ category, the entity was unable to identify the date the breach occurred.
Time taken to identify breaches | Percentage |
|---|---|
≤ 30 days | 78% |
1–2 months | 6% |
2–4 months | 5% |
4–12 months | 5% |
> 12 months | 4% |
Unknown | 1% |
Chart 6 – Time taken to identify breaches by source of breach
Chart 6 is a column chart showing the time taken by entities to identify breaches by source of breach.
The table is displayed from least to most time taken to identify breaches.
For notifications in the ‘Unknown’ category, the entity was unable to identify the date the breach occurred.
Time taken to identify breaches | Malicious or criminal attack | Human error | System fault |
|---|---|---|---|
≤ 30 days | 78% | 79% | 67% |
1–2 months | 6% | 7% | 7% |
2–4 months | 6% | 5% | 7% |
4–12 months | 6% | 5% | 7% |
> 12 months | 3% | 5% | 13% |
Unknown | 2% | 0% | 0% |
Chart 7 – Time taken to notify the OAIC of breaches
Chart 7 is a column chart showing the time taken by entities to notify the OAIC of breaches after becoming aware of the incident.
The table is displayed from least to most time taken to notify the OAIC of breaches.
For notifications in the ‘Unknown’ category, the entity was unable to advise the OAIC the date it became aware of the incident.
Time taken to notify the OAIC of breaches | Percentage |
|---|---|
≤ 30 days | 71% |
1–2 months | 16% |
2–4 months | 7% |
4–12 months | 4% |
> 12 months | 1% |
Unknown | 0% |
Chart 8 – Time taken to notify the OAIC of breaches by source of breach
Chart 8 is a column chart showing the time taken by entities to notify the OAIC of breaches after becoming aware of the incident, by source of breach.
The table is displayed from least to most time taken to notify the OAIC of breaches.
For notifications in the ‘Unknown’ category, the entity was unable to advise the OAIC the date it became aware of the incident.
Time taken to notify the OAIC of breaches | Malicious or criminal attack | Human error | System fault |
|---|---|---|---|
≤ 30 days | 65% | 79% | 93% |
1–2 months | 20% | 11% | 7% |
2–4 months | 10% | 3% | 0% |
4–12 months | 5% | 3% | 0% |
> 12 months | 0% | 2% | 0% |
Unknown | 0% | 1% | 0% |
Chart 9 – Source of breaches
Chart 9 is a column chart showing the source of data breaches.
The table is displayed from most to least notifications.
Source of data breach | Number of notifications (% of all notifications) |
|---|---|
Malicious or criminal attack | 250 (63%) |
Human error | 131 (33%) |
System fault | 15 (4%) |
Chart 10 – Malicious or criminal attack breakdown
Chart 10 is a column chart showing the breakdown of breaches resulting from malicious or criminal attacks.
The table is displayed from most to least notifications.
Malicious or criminal attack type | Number of notifications (% of malicious or criminal attacks) |
|---|---|
Cyber incident | 162 (65%) |
Social engineering/ impersonation | 58 (23%) |
Theft of paperwork or data storage device | 17 (7%) |
Rogue employee/ insider threat | 13 (5%) |
Chart 11 – Cyber incident breakdown
Chart 11 is a bar chart showing the breakdown of cyber incidents.
The table is displayed from most to least notifications.
Cyber incident type | Number of notifications (% of cyber incidents) |
|---|---|
Ransomware | 51 (31%) |
Phishing (compromised credentials) | 42 (26%) |
Compromised or stolen credentials (method unknown) | 40 (25%) |
Hacking | 13 (9%) |
Malware | 9 (6%) |
Brute-force attack (compromised credentials) | 5 (3%) |
Chart 12 – Human error breakdown
Chart 12 is a bar chart showing the breakdown of breaches resulting from human error.
The table is displayed from most to least notifications.
Human error type | Number of notifications (% of human error breaches) |
|---|---|
PI sent to wrong recipient (email) | 50 (38%) |
Unauthorised disclosure (unintended release or publication) | 31 (24%) |
PI sent to wrong recipient (mail) | 11 (8%) |
Unauthorised disclosure (verbal) | 10 (8%) |
PI sent to wrong recipient (other) | 8 (6%) |
Loss of paperwork / data storage device | 8 (6%) |
Failure to use BCC when sending email | 7 (5%) |
Unauthorised disclosure (failure to redact) | 3 (2%) |
PI sent to wrong recipient (fax) | 2 (2%) |
Insecure disposal | 1 (1%) |
Chart 13 – System fault breakdown
Chart 13 is a column chart showing the breakdown of breaches resulting from system faults.
The table is displayed from most to least notifications.
System fault type | Number of notifications (% of system fault breaches) |
|---|---|
Unintended release or publication | 11 (73%) |
Unintended access | 4 (27%) |
Chart 14 – Time taken to identify breaches – Top 5 sectors
Chart 14 is a column chart showing the time taken by entities in the top industry sectors to identify breaches.
The table is displayed from least to most time taken to identify breaches.
For notifications in the ‘Unknown’ category, the entity was unable to identify the date the breach occurred.
Time taken to identify breaches | Health service providers | Finance | Education | Legal, accounting & management services | Recruitment agencies |
|---|---|---|---|---|---|
≤ 30 days | 78% | 77% | 83% | 92% | 88% |
1–2 months | 10% | 4% | 6% | 0% | 8% |
2–4 months | 9% | 4% | 6% | 4% | 0% |
4–12 months | 1% | 8% | 0% | 0% | 0% |
> 12 months | 0% | 8% | 6% | 0% | 4% |
Unknown | 1% | 0% | 0% | 4% | 0% |
Chart 15 – Time taken to notify the OAIC of data breaches – Top 5 sectors
Chart 15 is a column chart showing the time taken by entities in the top industry sectors to notify the OAIC of breaches after becoming aware of the breach.
The table is displayed from least to most time taken to notify the OAIC of breaches.
For notifications in the ‘Unknown’ category, the entity was unable to advise the OAIC the date it became aware of the incident.
Time taken to notify the OAIC of breaches | Health service providers | Finance | Education | Legal, accounting & management services | Recruitment agencies |
|---|---|---|---|---|---|
≤ 30 days | 75% | 69% | 77% | 77% | 92% |
1–2 months | 14% | 23% | 11% | 8% | 4% |
2–4 months | 5% | 4% | 9% | 12% | 4% |
4–12 months | 4% | 2% | 3% | 4% | 0% |
> 12 months | 3% | 2% | 0% | 0% | 0% |
Chart 16 – Source of breaches – Top 5 sectors
Chart 16 is a clustered column chart showing the source of breaches by industry sector.
Source of breach | Health service providers | Finance | Education | Legal, accounting & management services | Recruitment agencies |
|---|---|---|---|---|---|
Malicious or criminal attack | 43 | 31 | 10 | 20 | 25 |
Human error | 34 | 17 | 21 | 6 | 0 |
System fault | 2 | 4 | 4 | 0 | 0 |
Chart 17 – Malicious or criminal attacks breakdown – Top 5 sectors
Chart 17 is a series of column charts showing the breakdown of breaches resulting from malicious or criminal attacks by top industry sectors.
Malicious or criminal attack type | Health service providers | Finance | Education | Legal, accounting & management services | Recruitment agencies | |||||
|---|---|---|---|---|---|---|---|---|---|---|
Cyber incident | 34 | 15 | 6 | 11 | 3 | |||||
Social engineering/ impersonation | 0 | 13 | 2 | 1 | 21 | |||||
Rogue employee/ insider threat | 6 | 1 | 1 | 0 | 1 | |||||
Theft of paperwork or data storage device | 3 | 2 | 1 | 8 | 0 | |||||
Total | 43 | 31 | 10 | 20 | 25 | |||||
Chart 18 – Cyber incident breakdown – Top 5 sectors
Chart 18 is a series of column charts showing the breakdown of breaches resulting from cyber incidents by top industry sectors.
Cyber incident type | Health service providers | Finance | Education | Legal, accounting & management services | Recruitment agencies |
|---|---|---|---|---|---|
Phishing | 14 | 5 | 2 | 5 | 0 |
Compromised or stolen credentials | 9 | 2 | 2 | 3 | 3 |
Ransomware | 8 | 6 | 0 | 3 | 0 |
Hacking | 3 | 2 | 0 | 0 | 0 |
Brute-force attack | 0 | 0 | 2 | 0 | 0 |
Malware | 0 | 0 | 0 | 0 | 0 |
Total | 34 | 15 | 6 | 11 | 3 |
Chart 19 – Human error breakdown – Top 5 sectors
Chart 19 is a series of column charts showing the breakdown of breaches resulting from human error by top industry sectors.
Human error type | Health service providers | Finance | Education | Legal, accounting & management services | Recruitment agencies |
|---|---|---|---|---|---|
PI sent to wrong recipient (email) | 13 | 7 | 7 | 3 | 0 |
Unauthorised disclosure (unintended release or publication) | 5 | 3 | 8 | 0 | 0 |
PI sent to wrong recipient (mail) | 1 | 5 | 1 | 1 | 0 |
Loss of paperwork/data storage device | 2 | 0 | 3 | 1 | 0 |
Unauthorised disclosure (verbal) | 3 | 2 | 0 | 0 | 0 |
PI sent to wrong recipient (other) | 3 | 0 | 1 | 1 | 0 |
Failure to use BCC when sending email | 3 | 0 | 1 | 0 | 0 |
Unauthorised disclosure (failure to redact) | 2 | 0 | 0 | 0 | 0 |
PI sent to wrong recipient (fax) | 2 | 0 | 0 | 0 | 0 |
Insecure disposal | 0 | 0 | 0 | 0 | 0 |
Total | 34 | 17 | 21 | 6 | 0 |
Chart 20 – System fault breakdown – Top 5 sectors
Chart 20 is a series of column charts showing the breakdown of breaches resulting from system faults by the top industry sectors.
Insurance did not report any system faults.
System fault type | Health service providers | Finance | Education | Legal, accounting & management services | Recruitment agencies |
|---|---|---|---|---|---|
Unintended access | 2 | 2 | 3 | 0 | 0 |
Unintended release or publication | 0 | 2 | 1 | 0 | 0 |
Total | 2 | 4 | 4 | 0 | 0 |
Footnotes
[1] The Privacy Act requires entities to take reasonable steps to conduct a data breach assessment within 30 days of becoming aware there are grounds to suspect they may have experienced an eligible data breach. Once the entity forms a reasonable belief that there has been an eligible data breach, they must prepare a statement and provide a copy to the OAIC as soon as practicable.
[2] A health service provider generally includes any private sector entity that provides a health service within the meaning of section 6FB of the Privacy Act, regardless of annual turnover.
[3] This sector includes banks, wealth managers, financial advisors, superannuation funds, and consumer credit providers (regardless of annual turnover).
[4] This sector includes private education providers only.
[5] This is the first reporting period in which recruitment agencies have been reported as a separate sector. They were previously considered part of the ‘personal services’ sector.
