Large Data Breaches Rise from 3 to 13: Four Steps for Small Firms
Large data breaches in Australia rose from 3 to 13 in the first half of 2026, according to the Office of the Australian Information Commissioner (OAIC), which makes data breach small business preparation worth doing now. If you store customer information, start with four things: list what data you hold and where it sits, delete what you don't need, check who has access, and write down who to call when something goes wrong.
The OAIC released these figures on 26 October 2026, covering 667 data breach notifications for the first six months of the year. Large breaches aren't the only concern. The report also shows that many incidents were detected quickly but notified late. And most of the exposed data is the kind that nail salons, medical clinics and accounting firms handle every day.
Key Takeaways
- According to the Office of the Australian Information Commissioner (OAIC), breaches affecting more than 100,000 people rose from 3 to 13, more than a fourfold increase.
- Contact details, identity documents, health records and financial information were the four most commonly exposed data types, and small businesses often hold all four.
- Almost two-thirds of breaches were detected within 10 days, yet 43% of notifications reached the OAIC after more than 20 days.
- Even if you aren't required to report, you should still have a response plan. When information is exposed, your customers are still harmed and your reputation can still suffer.
Key points
What do the latest OAIC data breach figures show?
The OAIC says it received 667 data breach notifications between January and June 2026. The most notable change is in large-scale breaches, meaning those affecting more than 100,000 people, which rose from 3 to 13.
In an analysis published on 28 October 2026, Hindsight Legal also identified the rise in large-scale breaches as the standout feature of this release.
That said, the figure of 667 only covers breaches reported to the OAIC. Most small businesses aren't required to report, so the statistics probably understate what is happening in this group. At the same time, large-scale breaches tend to occur at organisations holding vast amounts of data, not at a nail salon or an office with a handful of staff.
Even so, a small business can still be affected indirectly when customer information sits on a third party's systems, such as booking software, accounting software or an online storage service.
Which types of data are exposed most often?
According to OAIC figures, the most commonly exposed data types in the first half of 2026 were:
- Contact information: 483 breaches.
- Identity documents: 359 breaches.
- Health information: 212 breaches.
- Financial information: 177 breaches.
These are also the types of data small businesses commonly store. A nail salon keeps phone numbers and birthdates for appointment reminders, a clinic holds patient records, an accounting firm has tax details and bank account information, and a real estate office often has copies of tenants' passports or driver licences.
A common mistake is letting data scatter across places that nobody keeps track of: staff members' personal phones, Zalo messages, email inboxes, shared drives and old spreadsheets. When an incident happens, you can spend a lot of time just working out which data was exposed.
Detected early but reported late: where is the gap?
The OAIC found that almost two-thirds of breaches were detected within 10 days. However, 43% of notifications reached the OAIC after more than 20 days, and 19% after more than 30 days.
In our experience at Holdrix, the gap between detection and notification usually isn't a technology problem. Most of the time is lost answering questions that should have been settled beforehand: which data is affected, who has authority to make decisions, and who needs to be called.
Example (assumed scenario): a nail salon discovers that the reception computer has been infected with malware. Without a list of the data stored on that machine, the salon can't tell how many customers are affected, and doesn't know whether to contact its IT support provider, its insurer or its booking software vendor first.
The hidden cost lies in this waiting period. Every day of delay is another day customers haven't been warned to change their passwords or monitor their accounts.
Data breach small business obligations: do you have to report?
According to the OAIC, the data breach reporting scheme applies to most businesses with annual turnover above A$3 million. Some smaller businesses are also covered, such as health service providers.
So even a small clinic should check its obligations carefully under the Privacy Act. For a nail salon, restaurant or small office, whether reporting is mandatory depends on the circumstances, and you should confirm it with a legal professional.
It's also worth remembering that not being required to report doesn't mean you carry no risk. Customers whose information is exposed suffer the same harm, and your business can lose trust, especially in communities where news travels quickly by word of mouth.
Holdrix technology consulting services
How Holdrix works with clients
Where should a small business start?
You can begin with four steps, most of which don't require new software:
- List your customer data and where it's stored: record each type of information (contact, identity, health, financial) and which software, device or account it sits in.
- Delete information you don't need to keep: copies of ID that have served their purpose, old customer lists, and files exported from software and saved on personal devices. Records you must retain under tax or industry rules should be kept for the required period.
- Check who has access: remove accounts for former staff, stop sharing passwords, and turn on two-factor authentication for email and your management software.
- Write a list of who to call when something goes wrong: the decision-maker in your business, your IT support provider, software vendors, your insurer and legal advice. Print the list, because if your systems go down, a file saved on your computer may not open.
Once you've done these four steps, you can set out your incident response process on a single page and review it each year.
When might you not need outside consulting help?
If you only store customers' names and phone numbers in one booking system and few staff members have access, you can usually handle these steps yourself.
On the other hand, if you hold health records, identity documents or financial information, use several systems, or are covered by the reporting scheme, consider asking a specialist to review your setup.
Frequently Asked Questions
What is a data breach?
A data breach occurs when personal information is accessed, disclosed or lost without authorisation, for example through a cyber attack, an email sent to the wrong person or a lost device.
Does a small nail salon or restaurant have to report a data breach?
According to the OAIC, the reporting scheme applies to most businesses with turnover above A$3 million, and to some smaller businesses such as health service providers. If you're unsure, confirm your position with a legal professional.
What should a small business do first to reduce the risk of customer data exposure?
The first step is to list the customer data you hold and where it's stored. If you don't know what you have, it's hard to protect it, and hard to respond in time when an incident occurs.
In summary
The OAIC figures released in October 2026 show that large-scale data breaches are rising quickly and many are still reported late. A small business can reduce its risk significantly by knowing what it stores, keeping less data, controlling access and having a contact list ready.
Holdrix handles the tech, you focus on growth.
Not sure where your customer information sits or who can access it? Book a consultation
This article is general information only and is not legal, tax or migration advice.
Is a customer data protection plan right for your business?
Talk to the Holdrix team for advice and find the right solution for your business.
Where should your business start?
Talk to the Holdrix team for advice and find the right solution for your business.