Notifiable Data Breaches Report, July – December 2019

The Office of the Australian Information Commissioner (OAIC) publishes periodic statistical information about notifications received under the Notifiable Data Breaches (NDB) scheme to assist entities and the public to understand the operation of the scheme. This report captures notifications made under the NDB scheme for the period from 1 July 2019 to 31 December 2019.

Key findings for the July to December 2019 reporting period:

• 537 breaches were notified under the scheme, up from 460 in the previous six months
• Malicious or criminal attacks (including cyber incidents) remain the leading cause of data breaches, accounting for 64 per cent of all notifications
• Data breaches resulting from human error account for 32 percent of all breaches, down from 34 per cent in the last reporting period
• The health sector is again the highest reporting sector, notifying 22 per cent of all breaches
• Human error caused 43 per cent of data breaches in the health sector, compared to an average of 32 per cent across all notifications
• Finance is the second highest reporting sector, notifying 14 per cent of all breaches
• Most data breaches affected less than 100 individuals, in line with previous reporting periods
• Contact information remains the most common type of personal information involved in a data breach.