Record Data Breaches: Key Takeaways from OAIC Report
The Office of the Australian Information Commissioner (OAIC) has just released its latest data breach statistics and the findings are sobering. In 2024, Australia recorded 1,113 data breach notifications, the highest since mandatory reporting began in 2018. That’s a 25% increase over the previous year, and a clear signal that organisations can’t afford to let their guard down.
The second half of 2024 alone saw 595 breaches reported, surpassing the 527 notifications from January to June. Australian Privacy Commissioner Carly Kind emphasised the escalating threat landscape, stating, “The trends we are observing suggest the threat of data breaches, especially through the efforts of malicious actors, is unlikely to diminish, and the risks to Australians are only likely to increase.”
We’ve long spoken about the human, legal, and operational impacts of data breaches. This new report brings those risks into sharper focus and reinforces why cyber governance, awareness & upskilling, and response planning aren’t optional extras. They’re business-critical.
Here’s what the numbers are telling us—and what you can do about it.
A Snapshot of the OAIC Findings
- Malicious attacks continue to dominate, accounting for nearly 70% of all breaches.
- Cyber security incidents made up 61% of these, including ransomware, phishing, and compromised credentials.
- Health and Government sectors were the most affected, responsible for 20% and 17% of all reports, respectively, but no industry is immune.
- The Public Sector still lags behind the private sector when it comes to timely breach identification and notification.
The Commissioner’s message is clear…
“Organisations must improve their privacy and security practices to match the speed and sophistication of today’s threats.
And when a breach happens, they must act fast, not just to comply with the law, but to protect people.”
Read the Report here: Notifiable Data Breaches Report: July to December 2024
What This Means for Your Organisation
If you’ve followed our recent blogs on Cyber Preparedness, Microsoft Purview and Cyber Awareness, this latest report reinforces why we’ve made those areas a priority.
- Cyber Awareness Training is Non-Negotiable
The OAIC confirms that human error remains a consistent contributor to data breaches. Whether it’s a misaddressed email or clicking a phishing link, mistakes are costly. We’ve helped clients deliver staff training that goes beyond box-ticking — ensuring employees understand how breaches happen, what the risks are, are tested on it and how to respond.
Read more: The Role of the Board During a Crisis
- GRC and Data Classification Help You Respond Faster
Quick response and notification are essential under the Notifiable Data Breaches scheme. If your data is poorly classified or you lack a clear breach response plan, delays are inevitable and penalties can follow.
Tools like Microsoft Purview can help you locate, label, and protect sensitive data before a breach occurs. And if it does, you’re better positioned to assess impact and act quickly.
Read more: How Microsoft Purview can Benefits Organisations
- Executive Involvement is Crucial
The OAIC report isn’t just an IT issue, it’s a boardroom issue. We’ve worked with leadership teams to develop incident response strategies using our “Four R’s” approach: Readiness, Response, Recovery, and Remediation. This ensures cyber risk is understood and managed at the right level.
Read more: How Cyber Security Starts with People
How Diamond IT Can Help Review Your Cyber Posture
This isn’t just another report but a wake-up call. With breach numbers rising and attackers getting more sophisticated, businesses must rethink what “good enough” looks like when it comes to data protection.
If your organisation hasn’t reviewed its cyber risk strategy recently, now is the time. Whether it’s mapping your data flows, tightening your incident response, or training your team—we’re here to help. Contact us on 1300 307 907 today or fill out the form below.
