Data breaches affecting large numbers of people are on the increase, the latest statistics from the Office of the Australian Information Commissioner show.

Criminal attack is the leading cause of notifiable data breaches, as crooks seek contact and identity information.

Health service providers are the most frequent target and also had the largest number of breaches attributable to human error, according to OAIC data from January to June.

Education, business and professional associations, financial services and personal services made up the top five sectors for data breach notifications.

The OAIC received 667 notifications in the six months, up marginally from 662 in the second half of 2025. But the number of breaches affecting large numbers of people – between 100,000 and 250,000 individuals – doubled to six.

There were three breaches affecting between 500,000 and 1 million individuals, compared with none previously.

Privacy commissioner Carly Kind says the trend reinforces the need for organisations to be proactive in protecting personal information.

“It also underscores the importance of data minimisation. Organisations can’t lose personal information they don’t hold,” she said.

Entities are advised to ensure they collect and retain as little personal information as is necessary to perform their functions.