{"id":118,"date":"2026-07-14T10:14:36","date_gmt":"2026-07-14T00:14:36","guid":{"rendered":"https:\/\/mallen.com.au\/blog\/?p=118"},"modified":"2026-07-14T10:14:36","modified_gmt":"2026-07-14T00:14:36","slug":"data-breach-notifications-increase-to-all-time-high-in-2025-new-ndb-stats-show","status":"publish","type":"post","link":"https:\/\/mallen.com.au\/blog\/data-breach-notifications-increase-to-all-time-high-in-2025-new-ndb-stats-show\/","title":{"rendered":"Data Breach Notifications Increase to All-Time High in 2025, New NDB Stats Show"},"content":{"rendered":"

The Office of the Australian Information Commissioner (OAIC) has released its latest Notifiable Data Breaches (NDB) statistics, and the trend line keeps climbing. In 2025, the OAIC received 1,205 data breach notifications \u2014 an 8% increase on 2024’s 1,112, and the highest annual total since the mandatory reporting scheme began in 2018. For facilities managers, IT managers, and building owners overseeing access control, CCTV, and BMS networks, this is a timely reminder that the systems securing a building are themselves data-holding assets subject to these obligations.<\/p>\n\n

What the numbers show<\/h2>\n\n

Malicious or criminal activity \u2014 predominantly cyber hacking \u2014 remains the leading cause of reported breaches, accounting for 716 of the 1,205 notifications in 2025. Health service providers were the most affected sector, representing 19% of all notifications (225 incidents), followed by financial services (157), Australian Government agencies (118), business and professional associations (103), education (81), and legal\/accounting\/management services (81).<\/p>\n\n

While security integrators and building operators aren’t named as a discrete category in this dataset, the broader pattern is relevant: any organisation holding personal information \u2014 including visitor logs, access control credentials, CCTV footage with identifiable individuals, or tenant\/resident databases tied to intercom and access systems \u2014 falls within scope of the Privacy Act’s notifiable breach obligations if a breach is likely to cause serious harm.<\/p>\n\n

A new practical tool from the regulator<\/h2>\n\n

In response to the rising volume of notifications, the OAIC has published a quick reference guide and a downloadable self-assessment checklist to help entities determine whether an incident requires assessment, notification to the OAIC, and notification to affected individuals. This is a welcome, practical resource \u2014 particularly for smaller strata committees, clubs, and building operators who may not have in-house privacy counsel and are often unsure whether an incident (say, an access control database exposure or a compromised NVR with cloud backup) crosses the notification threshold.<\/p>\n\n

The regulator also points to its 2026 Australian Community Attitudes to Privacy Survey, which found 82% of Australians now consider data breaches a top privacy concern, up from 74% in 2023. That shift in public sentiment matters operationally: building occupants, strata owners, and club members increasingly expect operators to demonstrate they take data handling seriously, not just physical security.<\/p>\n\n

Operational implications for security and BMS operators<\/h2>\n\n

Security and building management systems generate and store more personal information than many operators realise:<\/p>\n\n