69% of Australian Data Breaches Are Cyber Attacks in 2024

Key takeaways

• 69% of the 595 data breaches reported to the OAIC in July to December 2024 were malicious or criminal cyber attacks, not accidents or system faults
• Australian organisations reported 1,113 data breaches to the OAIC across all of 2024, split 518 in the first half and 595 in the second
• Phishing that captured stolen login credentials caused 34% of cyber incident notifications, the single biggest attack method
• Ransomware accounted for 24% of cyber incident notifications, the second most common attack type
• Health service providers reported more breaches than any other sector: 121 notifications, 20% of the national total
• Only 52% of breached organisations notified the OAIC within 10 days of becoming aware of the breach
• Globally, the worst-hit small and medium businesses lose more than 7% of a year’s revenue to a single data breach, per Verizon’s 2026 Breach Impact Study
• Vulnerability exploitation now accounts for 31% of how attackers get in, a 55% jump in a single year, per Verizon’s 2026 Data Breach Investigations Report

69% of the data breaches reported to Australia’s privacy regulator in 2024 were malicious or criminal cyber attacks, according to the Office of the Australian Information Commissioner. Phishing and ransomware caused most of them. Globally, Verizon’s 2026 Breach Impact Study found the worst-hit small businesses lose more than 7% of annual revenue to a single breach.

Sixty-nine percent of the data breaches reported to Australia’s privacy regulator in 2024 were not accidents. They were malicious or criminal cyber attacks, deliberate attempts to get into a business’s systems and take something. The Office of the Australian Information Commissioner logged 595 of these notifications in the second half of 2024 alone, on top of 518 in the first half. Phishing that captured a stolen password caused more of those attacks than any other single method, followed closely by ransomware. Health providers, government agencies and finance firms got hit hardest, but the pattern shows up in businesses of every size. Globally, Verizon’s newest research puts a number on what a bad breach costs a small business: in the worst cases, more than 7% of a year’s revenue. This post walks through the OAIC’s 2024 breach data and Verizon’s 2026 global findings, sector by sector, so you can see where the risk actually sits. Every figure below traces back to a named, dated report, not a rounded-off guess.

How Many Australian Businesses Reported a Data Breach in 2024

The OAIC runs the Notifiable Data Breaches scheme, the legal channel every Australian organisation covered by the Privacy Act has to use when personal information is compromised. In the second half of 2024 alone, organisations filed 595 notifications. Add the 518 from the first half and the full-year total comes to 1,113, the most recent complete calendar-year figure the OAIC has published.

Of the 595 notifications in that second half, 404 were classed as malicious or criminal attacks, 69% of the total. Human error caused another 170, or 29%. System faults, the smallest category, caused just 12, or 2%. That split matters because it tells you where to spend your defence budget: nearly seven in ten breaches trace back to someone deliberately trying to get in, not a staff member clicking the wrong button.

Takeaway: 69% of Australian data breach notifications in the second half of 2024 came from a deliberate cyber attack, not a mistake.

What Kind of Cyber Attack Hits Australian Businesses Most

Not every attack looks like a Hollywood hacking scene. Most of them start with a login screen. Of the 247 cyber incidents the OAIC broke down in its H2 2024 report, phishing that captured compromised credentials accounted for 84 notifications, 34% of the total, the single most common method. Ransomware came next at 60 notifications, 24%. Compromised or stolen credentials where the method wasn’t identified made up another 51, 21%. Straight hacking accounted for 23 notifications, 9%, and brute-force attacks, where software just guesses passwords repeatedly, caused 16, 6%.

The pattern is worth sitting with. Between phishing and unidentified credential theft, more than half of every cyber incident traces back to someone getting hold of a password that should have been harder to steal. Multi-factor authentication and a password manager close most of that gap for free.

Takeaway: phishing and stolen credentials, not exotic hacking, cause more than half of all cyber incident notifications in Australia.

Which Industries Get Hit Hardest

Breach risk isn’t spread evenly across the economy. Health service providers filed 121 notifications in H2 2024, 20% of the national total and the single largest sector. Australian Government agencies followed with 100, 17%. Finance and superannuation firms reported 54, 9%. Legal, accounting and management services filed 36, 6%, and retail matched that at 34, also 6%. Together, these five sectors accounted for 58% of every breach notification lodged in the period.

Health and government sit at the top for a simple reason: they hold the data attackers want most, patient records and identity documents, and both sectors run on a mix of legacy systems and third-party contractors that widens the attack surface. Retail’s presence on the list is a reminder that this isn’t just a big-organisation problem. Any business that stores customer payment or contact details is a target.

Takeaway: health providers and government agencies filed more than a third of every Australian data breach notification between them.

How Fast Businesses Catch and Report a Breach

Speed matters once an attack succeeds, and the OAIC’s data shows most Australian organisations are still too slow. 66% of breaches in H2 2024 were identified within 30 days of occurring, which means a third took longer than a month to even notice. Once identified, only 52% of organisations notified the OAIC within 10 days, the window regulators expect for a fast, well-run response.

A slow response compounds every other cost on this page. The longer stolen credentials sit unreported, the longer an attacker has to use them elsewhere, and the more the eventual customer-facing fallout tends to cost. Basic monitoring, an incident response plan that’s actually been tested, and a clear line of responsibility inside the business are what move an organisation from the 34% still finding out late to the two-thirds that catch it fast.

Takeaway: a third of Australian organisations take more than 30 days to even discover a breach has happened.

What Global Data Shows About the Cost of a Breach

The OAIC counts notifications, not dollar figures. For cost data, the best available benchmark is global rather than Australia-specific: Verizon’s 2026 Data Breach Investigations Report, which broke down more than 22,000 breaches across 145 countries, alongside its 2026 Breach Impact Study, which analysed roughly 70,000 cyber insurance claims. These are worldwide figures, not an Australian sample, so treat them as a general benchmark rather than a local number.

The headline finding: in extreme cases, the worst-hit 2.5% of small and medium businesses lost more than 7% of a full year’s revenue to a single data breach. Separately, vulnerability exploitation, attackers walking in through unpatched software, jumped to 31% of how breaches start, a 55% increase on the year before. Breaches involving a third-party vendor or supplier rose 60% year on year and now make up 48% of every breach in the dataset. Attackers are shifting targets too: the report’s top takeaways note that phishing attempts against mobile devices get 40% higher click rates than the same attempts sent by email, one reason Verizon flags mobile as “the new favorite target.”

Takeaway: globally, the worst-hit small businesses lose more than 7% of a year’s revenue to one breach, and unpatched software is a fast-growing way in.

What This Means If You’re Running a Business

None of this data says a website rebuild stops a determined attacker. It doesn’t. What it does show is that most of the entry points in these figures, stolen passwords, unpatched software, a vendor with weak security, are fixable with unglamorous, ongoing maintenance rather than a one-off spend.

A site running on old plugins, shared cheap hosting with no monitoring, and staff logins with no multi-factor authentication ticks every box on the OAIC’s attack-method list. If an attack does succeed, knowing what an hour of downtime actually costs your business helps you decide how much to spend on prevention before the fact, not after. Our free downtime calculator puts a number on what an outage, cyber attack or otherwise, would cost your business per hour, a useful starting point before you decide how much a proper security review is worth.

If you want a second set of eyes on how exposed your current website, hosting and login setup actually are, talk to RockingWeb about a straightforward security review.

Takeaway: most of the attack methods in this data are closed off by ordinary, ongoing maintenance, not an expensive one-off fix.

Sources

• Office of the Australian Information Commissioner, Notifiable Data Breaches Report: July to December 2024 (published 13 May 2025)
• Verizon, 2026 Data Breach Investigations Report (published 19 May 2026)
• Verizon, 2026 Breach Impact Study, SMB findings (published 16 June 2026)