Notifiable Data Breaches Report: July to December 2024

Health service providers

121

20%

Australian Government

100

17%

Finance (incl. superannuation)

54

9%

Legal, accounting and management services

36

6%

Retail

34

6%

Total

345

58%

Contact information

Information that is used to contact an individual, for example, a home address, phone number or email address

Eligible data breach

An eligible data breach occurs when:

• Personal information has   been lost, or accessed or disclosed without authorisation
• It is likely to result in serious harm to one or more individual
• The organisation or Australian Government agency has not been able to   prevent the likely risk of serious harm with remedial action

Financial details

Information relating to an individual’s finances, for example, bank account or credit card numbers

Health information

As defined in s 6 of the Privacy Act 1988 (Cth)

Identity information

Information that is used to confirm an individual’s identity, such as a passport number, driver licence number or other government identifier

Other sensitive information

Sensitive information, other than health information, as defined in s 6 of the Privacy Act, for example, sexual orientation, political or religious views

Personal information (PI)

Information or an opinion about an identified individual or an individual who is reasonably identifiable

Sensitive information

Sensitive information is personal information that includes information or an opinion about an individual’s:

• racial or ethnic origin
• political opinions or associations
• religious or philosophical beliefs
• trade union membership or associations
• sexual orientation or practices
• criminal record
• health or genetic information
• some aspects of biometric information

Tax file number

An individual’s personal reference number in the tax and superannuation systems, issued by the Australian Taxation Office

Human error

An unintended action by an individual directly resulting in a data breach, for example, inadvertent disclosure caused by sending a document containing personal information to the incorrect recipient

Failure to use BCC when sending email

Sending an email to a group by including all recipient emails addresses in the ‘To’ field, thereby disclosing all recipient email addresses to all recipients

Insecure disposal

Disposing of personal information in a manner that could lead to its unauthorised disclosure, for example, using a public rubbish bin to dispose of customer records instead of a secure document disposal bin

Loss of paperwork/data storage device

Loss of a physical asset containing personal information, for example, leaving a folder or a laptop on a bus

PI sent to wrong recipient (email)

Personal information sent to the wrong recipient via email, for example, as a result of a misaddressed email or having a wrong address on file

PI sent to wrong recipient (fax)

Personal information sent to the wrong recipient via facsimile machine, for example, as a result of an incorrectly entered fax number or having a wrong fax number on file

PI sent to wrong recipient (mail)

Personal information sent to the wrong recipient via postal mail, for example, as a result of a transcribing error or having a wrong address on file

PI sent to wrong recipient (other)

Personal information sent to the wrong recipient via channels other than email, fax or mail, for example, delivery by hand or uploading to web portal

Unauthorised disclosure (failure to redact)

Failure to effectively remove or de-identify personal information from a record before disclosing it

Unauthorised disclosure (unintended release or publication)

Unauthorised disclosure of personal information in a written format, including paper documents or online

Unauthorised disclosure (verbal)

Disclosing personal information verbally without authorisation, for example, calling it out in a waiting room

Malicious or criminal attack

A malicious or criminal attack deliberately crafted to exploit known vulnerabilities for financial or other gain

Brute-force attack (compromised credentials)

A typically unsophisticated and exhaustive process to determine a cryptographic key or password that proceeds by systematically trying all alternatives until it discovers the correct one

Compromised or stolen credentials (method unknown)

Credentials are compromised or stolen by methods unknown

Cyber incident

A cyber incident targets computer information systems, infrastructures, computer networks or personal computer devices

Hacking (other means)

Unauthorised access to a system or network (other than by way of phishing, brute-force attack or malware), often to exploit a system’s data or manipulate its normal behaviour

Malware

Short for ‘malicious software’. A software used to gain unauthorised access to computers, steal information and disrupt or disable networks. Types of malware include trojans, viruses and worms

Ransomware

Malicious software that makes data or systems unusable until the victim makes a payment

Rogue employee/
insider threat

An attack by an employee or insider acting against the interests of their employer or other entity

Phishing (compromised credentials)

Untargeted, mass messages sent to many people asking for information, encouraging them to open a malicious attachment, or visit a fake website that will ask the user to provide information or download malicious content

Social engineering/ impersonation

An attack that relies heavily on human interaction to manipulate people into breaking normal security procedures and best practices in order to gain access to systems, networks or physical locations

Theft of paperwork or data storage device

Theft of paperwork or data storage device

System fault

A business or technology process error not caused by direct human error