Criminal attacks, human error drive data breaches

The number of data breaches reported to the Office of the Australian Information Commissioner (OAIC) rose 25% in 2024; 54 or 9% of which occurred at financial services organisations.

New statistics from the OAIC show there was a total of 1113 notifications received about data breaches in the 2024 calendar year. In 2023, there was 893.

Of the 1113, 595 came in the second half of the year.

Malicious and criminal attacks were the main source of breaches. They accounted for 69% of the notifications received by the OAIC in the second half of 2024; 61% were cybersecurity incidents.

As for other sources, 29% were the result of human error and 2% were due to system faults.

In financial services, malicious and criminal attacks accounted for 30 of the 54 breaches reported. Twenty-one were due to human error, while the balance was the result of system faults.

Some 34% of all breaches took more than 30 days to be identified. Of those that were the result of a system fault, 37% took more than 30 days.

Interestingly, the most reports came in from the health services sector and the Australian government, with the OAIC saying the public sector significantly lags the private sector when it comes to identifying and notifying breaches.

Of the total, 63% impacted less than 100 people.

The record number of data breaches in 2024 highlights the significant threats facing Australians' privacy that organisations and agencies need to effectively manage, Australian Privacy Commissioner Carly Kind said.

"The trends we are observing suggest the threat of data breaches, especially through the efforts of malicious actors, is unlikely to diminish, and the risks to Australians are only likely to increase," she said.

"Businesses and government agencies need to step up privacy and security measures to keep pace.

"Australians trust businesses and government agencies with their personal information and expect it to be treated with care and kept secure."