Healthcare Data Breach Statistics in Australia, 2019 to 2026
What the OAIC’s Notifiable Data Breaches figures show about the health sector, the incidents behind them and what they mean for GP clinics, medical centres and allied health providers.
Health providers have reported more data breaches than any other sector in every half-year since mid-2019. The first half of 2026 is the highest in this series, with 149 notifications.
Health sector breach notifications
Notifications to the OAIC by health service providers, by half-year.
- Jul–Dec 2019117
- Jan–Jun 2020115
- Jul–Dec 2020123
- Jan–Jun 202185Eastern Health ransomware, March 2021
- Jul–Dec 202183
- Jan–Jun 202279Medlab Pathology, February 2022
- Jul–Dec 202271Medibank, October 2022
- Jan–Jun 202363
- Jul–Dec 2023104
- Jan–Jun 2024102MediSecure, April–May 2024
- Jul–Dec 2024121
- Jan–Jun 202596Genea, February 2025
- Jul–Dec 2025128
- Jan–Jun 2026149
Source: OAIC Notifiable Data Breaches reports, July 2019 to June 2026. Totals are revised in later reports, so figures can differ slightly between publications. Reviewed 28 October 2026.
Major incidents
The bar under each incident shows how many people were affected, scaled against the largest, MediSecure at 12.9 million. A hatched bar means no confirmed count.
Eastern Health, Victoria
Mar 2021Ransomware shut down systems across a metropolitan hospital network.
Not reported as a countMore detail
Ransomware was confirmed after the 16 March 2021 incident. Most elective surgery was postponed for weeks and staff reverted to manual processes.
Medlab Pathology, owned by Australian Clinical Labs
Feb 2022First civil penalty ordered under the Privacy Act: $5.8 million.
223,000 peopleMore detail
In October 2025 the Federal Court ordered $5.8 million: $4.2 million for failing to take reasonable steps to protect personal information (APP 11.1), $800,000 for the delayed breach assessment and $800,000 for the late statement to the Commissioner. ACL also contributed $400,000 to the OAIC’s costs.
Medibank and ahm
Oct 2022The OAIC alleges serious interference with the privacy of 9.7 million people.
9.7 million peopleMore detail
The OAIC filed civil penalty proceedings in June 2024 and a class action is running in parallel. A trial was ordered for October 2027, and in October 2026 the court was reconsidering whether the two cases are heard together. No liability finding has been made.
MediSecure, electronic prescriptions
Apr–May 2024The largest number of people ever notified to the OAIC under the scheme.
12.9 million peopleMore detail
The data covered March 2019 to November 2023. The OAIC closed its inquiry because MediSecure had entered administration, and the AFP investigation was reported as continuing.
Genea, IVF provider
Feb 2025Sensitive fertility and medical records were published on the dark web.
Number not disclosedMore detail
Genea identified suspicious activity on 14 February 2025. The Termite ransomware group claimed about 940 GB of data. Genea has not stated how many people were affected. A representative complaint was lodged with the OAIC in October 2025.
Several health providers
Feb–Oct 2026A run of incidents across clinics, hospitals and cancer care.
Numbers not confirmedMore detail
Reported incidents include the Aeromedical Society of Australasia (listed by LockBit, February), GO2 Health (phishing, July), St Andrew’s Hospital Adelaide (October), Hunter Neurology (October, tens of thousands of records claimed) and Icon Cancer Centre (October, more than 31,000 records claimed). Several rely on threat actor claims and may change.
This is a selection, not a complete list. The OAIC publishes aggregate statistics and does not publish a register of every notifying organisation. Incidents based on threat actor claims are unconfirmed.
What this means for your practice
Small practices are in scope
Most notified breaches affect 100 people or fewer, and private health service providers are covered by the scheme whatever their turnover.
Speed is part of compliance
In 2025, 41 of the 124 health notifications with timing data took more than 30 days to reach the OAIC. The Medlab penalty included a separate amount for delay.
Suppliers carry your risk
Several large incidents involved third-party providers. Know where your clinical, billing and cloud software holds patient data. Review the seven core safeguards.
View the data as a table
| Period | Health | All sectors | Share |
|---|---|---|---|
| Jul–Dec 2019 | 117 | 537 | 22% |
| Jan–Jun 2020 | 115 | 518 | 22% |
| Jul–Dec 2020 | 123 | 539 | 23% |
| Jan–Jun 2021 | 85 | 446 | 19% |
| Jul–Dec 2021 | 83 | 464 | 18% |
| Jan–Jun 2022 | 79 | 396 | 20% |
| Jul–Dec 2022 | 71 | 497 | 14% |
| Jan–Jun 2023 | 63 | 407 | 15% |
| Jul–Dec 2023 | 104 | 483 | 22% |
| Jan–Jun 2024 | 102 | 527 | 19% |
| Jul–Dec 2024 | 121 | 595 | 20% |
| Jan–Jun 2025 | 96 | 532 | 18% |
| Jul–Dec 2025 | 128 | 670 | 19% |
| Jan–Jun 2026 | 149 | 667 | 22% |
Shares are calculated from the figures shown and rounded. January to June 2024 was first reported as 527 notifications and later restated as 518. Notifications under the My Health Records Act are not included, and public hospitals are generally covered by state and territory privacy laws rather than this scheme.
Official sources
OAIC Notifiable Data Breaches statistics and reports Half-yearly reports to December 2024, the calendar 2025 release (6 July 2026) and the January to June 2026 release (26 October 2026). Figures for July to December 2025 and January to June 2026 come from the OAIC release and secondary reporting of its dashboard.Find out where your practice stands
Australian GP clinics and medical centres can use a healthcare cyber security risk assessment to identify security gaps, review safeguards and prioritise practical improvements.