The real cost of a data breach in Australia

The headline number

The average cost of a data breach in Australia in 2026

IBM's 2026 study puts the average cost of a data breach in Australia at $4.22 million, with financial services at $6.31 million, technology at $5.51 million and healthcare at $5.09 million. The average incident exposed 22,400 records at a cost of $167 per record. Globally the figure rose 12 per cent in a year to a record US$4.99 million, reversing the improvement recorded in 2025.

These averages come from organisations large enough to be studied, and they measure the direct costs of an incident: detection, containment, notification, legal and forensic fees, lost business. Most Australian organisations will see a smaller number in absolute terms and a larger one in proportion to revenue. The ASD's figures, self-reported by the businesses making cybercrime reports, show the average cost per report rose 50 per cent in a year to $80,850, with medium businesses at $97,200 and large businesses at $202,700. Those figures are per incident and exclude what comes after.

The direct bill has grown only modestly since 2023. The costs that follow it have multiplied, and they now arrive on statutory timetables.

The costs that arrive later

Privacy Act penalties, litigation and reporting obligations after a breach

Regulatory penalties are now real money, with precedent

In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million in civil penalties plus costs over the 2022 Medlab Pathology breach: $4.2 million for failing to take reasonable steps to secure personal information across 223,000 contraventions, $800,000 for failing to assess the breach in time, and $800,000 for failing to notify in time. It was the first civil penalty ever imposed under the Privacy Act, and it established that the failure to assess and notify promptly is penalised separately from the failure to secure.

The OAIC has civil penalty proceedings on foot against Medibank, over the data of 9.7 million people, and against Optus, filed in August 2025 over roughly 9.5 million. Each carries a maximum of $2.22 million per contravention under the penalty regime that applied at the time. For breaches occurring after December 2022 the maximum for a serious or repeated interference with privacy is the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover. A mid-tier penalty of up to $3.3 million, and infringement notices, were added in December 2024 for conduct that falls short of serious.

Individuals can now sue directly

Since 10 June 2025 a statutory tort for serious invasions of privacy has been in force. A person whose privacy is seriously invaded, including through misuse of their information, can bring an action without needing to show financial loss. Combined with the representative complaint mechanism that Maurice Blackburn has used for Qantas customers, and the class actions that followed Optus, Medibank and Latitude, the litigation exposure from a breach now runs on two tracks in parallel with the regulator.

Ransomware payments must be reported within 72 hours

Under the Cyber Security Act 2024, any business with annual turnover of $3 million or more that makes a ransomware or cyber extortion payment must report it to the Australian Signals Directorate within 72 hours. The obligation started on 30 May 2025 and the enforcement phase began on 1 January 2026. A decision many boards still treat as private is now a regulated event with a paper trail.

Regulated sectors carry their own clocks

APRA's CPS 230 on operational risk commenced on 1 July 2025, and from 1 July 2026 every material service provider contract held by a bank, insurer or superannuation fund must comply. The practical effect is that a breach at a supplier to a regulated entity becomes the regulated entity's incident, with the tolerance levels and notification duties that follow. Anyone selling into financial services has inherited that scrutiny whether or not they are regulated themselves.

The next round is already drafted

On 31 August 2026 the Attorney-General released the exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, the second tranche of Privacy Act reform. It proposes around forty changes, including a fair and reasonable test for the handling of personal information, a controller and processor framework, a right to erasure for large platforms, and a positive duty to mitigate harm after any breach. Submissions closed on 18 September and the Government intends to introduce the Bill before the end of 2026. The Children's Online Privacy Code must be registered by 10 December 2026.

How breaches start

How data breaches happen in Australia: credentials, people and suppliers

The pattern in the Australian data has held for several years. In the OAIC's most recent detailed breakdown, 55 per cent of cyber incidents began with credentials, either phished (34 per cent) or stolen by unknown means (21 per cent). Ransomware accounted for a further quarter. The ASD found compromised accounts or credentials in 42 per cent of the more serious incidents it responded to. Human error, mostly misdirected email, caused 37 per cent of all notified breaches in the first half of 2025, up from 29 per cent.

The largest Australian incidents of the past eighteen months follow the same lines. Qantas lost 5.7 million customer records in June 2025 when an overseas third-party contact centre was socially engineered by phone; the OAIC closed its inquiries in July 2026 without further action, but the records were leaked publicly and a representative complaint is proceeding. In April 2025 credential stuffing hit AustralianSuper, Rest, Hostplus, Australian Retirement Trust and Insignia, with SMS two-factor authentication bypassed by SIM swap in some cases and four AustralianSuper members losing roughly $500,000 between them. Origin Energy confirmed in July 2026 that data on around 900,000 current and former customers had been accessed.

IBM's 2026 Australian data ranks the most expensive initial vectors as abuse of valid accounts ($4.87 million), social engineering and IT impersonation ($4.78 million) and phishing ($4.48 million). All three are failures of identity, verification and the controls around privileged access. Four of the eight Essential Eight strategies address them directly, which is why insurers have started asking for a maturity level rather than a list of products.

What changed in 2026

AI-enabled attacks, shadow AI and the cyber insurance market in 2026

AI-enabled attacks became ordinary

One in four malicious breaches in IBM's 2026 study was AI-enabled, a 56 per cent increase in a year, at an average cost of US$6 million. In Australia 32 per cent of malicious attacks involved AI-generated elements. The techniques are older ones made cheaper: voice phishing that sounds like the CFO, help-desk impersonation that passes the security questions, résumés and interview performances that belong to someone other than the person who turns up on day one. Recorded Future's research into North Korean operatives obtaining software engineering roles at Western companies through fabricated identities is the sharpest current example, and the subject of our executive briefing on 27 October.

Shadow AI became a data breach vector in its own right

Verizon's 2026 report found the share of employees using unapproved AI tools tripled in a year, from 15 to 45 per cent. IBM found that more than a fifth of organisations had suffered a breach involving their own AI models or applications, most often through compromised APIs and plug-ins or misconfigured cloud AI workloads, and that 92 per cent of those organisations had no AI access controls in place. Organisations using AI extensively in their security operations, by contrast, identified breaches 68 days faster and paid $1.75 million less per breach in Australia than those using none.

Cyber insurance is softer on price and harder on evidence

Australian cyber premiums fell five to ten per cent in the first half of 2026 according to Marsh, continuing a decline that ran through 2025, and global rates have fallen for twelve consecutive quarters. Capacity is up and the class has been profitable for insurers. Underwriting has tightened at the same time: MFA on all remote and privileged access, endpoint detection and response, tested backups and an evidenced Essential Eight maturity level are now standard questions, and healthcare in particular is under closer scrutiny. Coalition's 2026 claims data shows business email compromise and funds transfer fraud making up 58 per cent of claims, with the average funds transfer loss near $199,000. Take-up remains low: the Australian Institute of Criminology found only 3.7 per cent of respondents held cyber insurance in 2025, while a quarter of small business owners had been hit by cybercrime in the previous year.

Breaches are taking longer to find again

After years of improvement, the global average time to identify and contain a breach lengthened to 247 days in 2026. In Australia, breaches that ran past 200 days cost $5.17 million against $3.26 million for those contained sooner. Only 32 per cent of Australian organisations had encryption in place across sensitive data at rest and in transit at the time they were breached.

Where the money goes

The cost lines of a data breach

The first three lines below are what an incident budget covers. The remaining five are what the board will still be dealing with a year later.

Every tender response, insurance proposal and customer security schedule an organisation has completed is a statement about its controls. When a breach shows those statements were aspirational, a failure to secure becomes a misrepresentation as well, and the internal record of what was known and left unfixed becomes discoverable. The Australian Clinical Labs penalty turned in large part on what the company was aware of before the breach and had not acted on.

What reduces the cost

How to reduce the cost of a data breach: five board decisions

Most of this advice has been given before. Since 2025 the cost of ignoring it comes with a penalty schedule, a class action bar, an insurer's questionnaire and a 72-hour clock. The organisations that spend least on cyber risk over the next few years will be those that can prove, on request, what they have done.

Quick answers

Data breach costs in Australia: common questions

What is the average cost of a data breach in Australia?

$4.22 million in 2026, according to IBM's Cost of a Data Breach study, with financial services at $6.31 million and healthcare at $5.09 million. For smaller organisations the ASD's self-reported figures are a better guide: $56,600 per cybercrime report for small businesses, $97,200 for medium and $202,700 for large.

How many data breaches were reported in Australia in 2025?

1,205 notifications under the Notifiable Data Breaches scheme, up 8 per cent on 2024 and the highest annual total since the scheme began in 2018. Health providers made the most notifications, followed by finance and the Australian Government.

What are the penalties for a data breach under the Privacy Act?

For a serious or repeated interference with privacy, the greater of $50 million, three times the benefit obtained, or 30 per cent of adjusted turnover. A mid-tier penalty of up to $3.3 million and infringement notices apply to lesser breaches. The first civil penalty, $5.8 million against Australian Clinical Labs, was ordered in October 2025. Individuals can also sue directly under the statutory tort in force since June 2025.

Do ransomware payments have to be reported in Australia?

Yes. Since 30 May 2025, businesses with turnover of $3 million or more must report any ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours under the Cyber Security Act 2024. Enforcement began on 1 January 2026.

What does cyber insurance require in 2026?

Premiums have fallen but underwriting questions have hardened. Insurers commonly require multi-factor authentication on remote and privileged access, endpoint detection and response, tested offline backups, and increasingly an evidenced Essential Eight maturity level. Healthcare organisations face closer scrutiny than most.