Data breaches big enough to touch a million people stopped being rare events in 2025-26. Australia's privacy regulator recorded 15 of them, up from just two the year before.
The figure appears in Australian Information Commissioner Elizabeth Tydd's overview of the Office of the Australian Information Commissioner's Annual Report 2025-26. It was released on 22 October in two volumes, the second devoted to freedom of information (FOI).
A sevenfold rise in mega breaches has forced the OAIC to rethink how it reports them. Tydd says the regulator has revised its Notifiable Data Breaches Report to give greater insight into what causes such incidents and how to prevent them.
The largest was notified as the year began. On 28 June 2025, a caller posing as Qantas IT phoned an agent at a third-party contact centre. The agent was talked into connecting a modified Salesforce tool to the airline's customer platform.
About 5.67 million customer records were extracted, including those of 5.12 million Australians. No password was stolen and no multi-factor prompt was triggered, as IDM reported when the OAIC closed its inquiries in July.
The Qantas data was published online on 12 October 2025 by the Scattered Lapsus$ Hunters extortion group, despite a NSW Supreme Court injunction. The OAIC closed its preliminary inquiries without an investigation, though complaints are being handled separately.
A related group, ShinyHunters, struck the education sector in May 2026. It breached Instructure's Canvas learning platform, used by about 9,000 schools and universities worldwide.
In Queensland, students and staff at state schools since 2020 had names, emails and school locations exposed. Universities and TAFEs on both sides of the Tasman were caught up, IDM reported.
In January 2026, Victoria's Department of Education disclosed that a hacker had reached student data across all 1,700 government schools. Names, email addresses, encrypted passwords and year levels were accessed.
Scale, Not Volume
The rise is about size more than frequency. The OAIC received 1,327 breach notifications in 2025-26, the most in the scheme's history, but only 18 per cent more than the year before.
The trend has continued into 2026. Between January and June, three breaches affected between 500,000 and one million Australians, up from none in the previous half. Breaches reported to the OAIC affecting more than one million people globally rose from four to 11.
Privacy Commissioner Carly Kind writes that breaches and harms "continue to occur with worrying frequency". She notes more breaches were notified in 2025-26 than in any year since the scheme began in 2018.
Public concern is rising alongside them. The OAIC's 2026 community attitudes survey of more than 1,500 Australians found 87 per cent are more concerned about their privacy than five years ago. Privacy complaints rose 60 per cent to 5,268, led by health service providers, finance and social media.
Enforcement over older breaches also moved forward. In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million over a 2022 breach affecting more than 200,000 people. It was the first civil penalty order under the Privacy Act.
The OAIC has also commenced civil penalty proceedings against Optus over security failures behind its 2022 breach.
Kind issued determinations on tracking pixels, rent tech apps and facial recognition, and ran the first privacy compliance sweep in January 2026.
"The significant increase in incoming matters was reflective of the importance the community places on information access and privacy," Tydd said in releasing the report.
FOI System Strained by Home Affairs
The FOI side tells a parallel story of rising demand. Agencies and ministers received a record 46,933 FOI requests, up 8 per cent. Applications for Information Commissioner (IC) review jumped 42 per cent to 3,025.
The Department of Home Affairs accounted for 1,425 of those review applications, nearly half. The FOI volume says its impact on the system "should not be understated".
Most reviews stem from silence. Eighty per cent of incoming IC review cases arose because agencies made no decision within the statutory timeframe.
The OAIC is using public rankings to push for better results. Its FOI Leaderboard, launched in March 2026, names agencies with three years of perfect timeliness.
It also cut the average time to finalise an IC review from 13.5 months to 7 months. Four complaint investigations found the Australian Federal Police, Veterans' Affairs, Defence and the NDIA had all failed to acknowledge requests on time.
The year ahead brings more work. A new automated decision-making transparency obligation under the Privacy Act commences in December 2026, alongside the Children's Online Privacy Code and further privacy reform.
The OAIC will meet that load with 175 staff in 2026-27, one fewer than this year, as IDM has reported.