How to check data breach Australia

Data breaches are a growing concern in Australia. Cyberattacks and data security incidents are becoming more frequent and more damaging. The Office of the Australian Information Commissioner (OAIC) tracks these incidents and publishes regular reports on their impact.

To address this threat, Australia introduced the Notifiable Data Breaches (NDB) scheme. This scheme requires businesses to notify affected individuals and the OAIC when a breach is likely to cause serious harm.

How Do I Know if I Have Been Hacked?

It’s important to recognise the warning signs that your data may have been compromised. Here are the most common signals to watch for:

• Notifications from companies. You might receive an email or letter from a business telling you your data was involved in a breach.
• Unfamiliar account activity. Look out for unusual login attempts, changes to your account settings, or transactions you don’t recognise.
• Unexpected messages. Suspicious emails, texts, or social media messages — especially ones asking for personal details — can be a sign.
• Account access issues. If you suddenly can’t log into an account and haven’t changed your password, someone else may have.
• Unexplained charges. Check your bank, credit card, and other financial accounts for transactions you didn’t make.

If you suspect you’ve been hacked, the Australian Cyber Security Centre (ACSC) can help. They provide guidance and resources for people affected by cyber incidents. You can also contact a local IT support provider for hands-on assistance.

How to Check if Your Data Has Been Breached

There are several tools and resources you can use to find out if your data has been exposed.

• Have I Been Pwned. The “Have I Been Pwned” website lets you enter your email address or phone number to see if it has appeared in a known data breach.
• Government resources. The OAIC and IDMatch websites offer guidance and tools for Australians affected by data breaches.
• Credit reporting agencies. In Australia, agencies such as Equifax, Illion, and Experian can flag suspicious activity linked to your personal information.
• Company websites. Many businesses proactively publish information about breaches on their websites. Check the websites of companies you deal with regularly.

What Does a Breach Notification Email Look Like?

If your data has been compromised, you’ll typically receive a notification email from the affected organisation. A genuine breach notification email should include:

• Organisation details. The business’s name and contact information.
• Breach description. How the breach occurred and the extent of data compromised.
• Data compromised. A clear list of what specific data was affected.
• Recommended actions. Steps you should take, such as changing your password or monitoring your accounts.
• Contact information. Details for getting further help or asking questions.

Here is an example of what a breach notification email might look like:

Subject: Important Security Notice — Data Breach at [Company Name]

Dear [Customer Name],

We are writing to inform you of a recent security incident at [Company Name]. On [Date], we discovered that unauthorised individuals gained access to our systems. This may have exposed some of your personal information.

What information was affected:

• Your contact information (names and business email addresses)
• Project-related documents and data

We have no evidence that sensitive financial information or personal data beyond business contact details was accessed.

So we recommend you take the following steps to protect your information:

• Review your internal security protocols and ensure your employees are aware of best practices for data security.
• Remind employees to be alert to suspicious emails and phishing attempts.
• If you have shared login credentials for any joint projects or platforms, change those passwords immediately.

We take the security of your information very seriously. We sincerely apologise for this incident and any distress it may cause.

If you have any questions or concerns, please contact us at [email address] or [phone number].

Sincerely,
[Company Name] Security Team

What Should I Do if I Receive a Data Breach Notification?

Receiving a breach notification can be unsettling. Take these steps to protect yourself quickly.

Protect Your Personal Information

• Change your passwords immediately — especially for the affected service and any account where you use the same password.
• Enable multi-factor authentication (MFA) on all important accounts.
• Be alert to phishing attempts. Scammers may use your breached data to target you.
• Consider placing a credit freeze or fraud alert with Australian credit reporting agencies.

Monitor Your Financial Accounts

• Review your bank statements, credit card statements, and other financial accounts for suspicious activity.
• Set up account alerts so you’re notified of any unusual transactions immediately.
• If you notice suspicious activity, report it to your bank or financial institution right away.

Report the Breach

• Contact the affected organisation to report the breach and gather information about the incident.
• If the breach involves tax file numbers or other tax-related information, notify the Australian Taxation Office (ATO).

Recover from the Breach

• Secure your systems. Immediately take steps to contain the breach and prevent further unauthorised access.
• Investigate the breach. Conduct a thorough investigation to determine the scope of the breach and identify the root cause.
• Notify affected individuals. If the breach is likely to cause serious harm, notify affected individuals and the OAIC as required under the NDB scheme.
• Review and improve security. Use the incident as an opportunity to strengthen your security measures and prevent future breaches.

How to Prevent a Data Breach in Your Business

Prevention is always better than recovery. Put these fundamentals in place before a breach occurs:

• Strong passwords and multi-factor authentication. Enforce strong, unique passwords for all employee accounts. Enable MFA wherever possible.
• Data encryption. Encrypt sensitive data — both in transit and at rest — to add an extra layer of protection.
• Regular security awareness training. Educate your employees about cybersecurity best practices. This includes how to recognise phishing attempts and suspicious activity.
• Incident response plan. Develop and regularly test an incident response plan. Your business needs to be ready to act quickly if an incident occurs.

Australian Data Breach Laws and Regulations

Australian businesses must understand their legal obligations around data breaches. Here are the key laws and regulations to know:

• Notifiable Data Breaches (NDB) scheme. Businesses with an annual turnover of $3 million or more must report eligible data breaches to the OAIC and affected individuals.
• Privacy Act 1988. This Act sets out the obligations of Australian businesses to protect personal information. It also establishes the rights of individuals to access and correct their personal information.
• Privacy and Other Legislation Amendment Bill 2024. This Bill introduces stricter penalties for non-compliance and clarifies security obligations for Australian businesses.

Recent Examples of Data Breaches in Australian Businesses

These high-profile cases show the scale of the problem:

• Optus data breach (September 2022). This breach exposed the personal information of 9.8 million customers, including names, dates of birth, phone numbers, and identity document details.
• Medibank data breach (December 2022). This breach compromised the personal and health information of 9.7 million customers.

What Are the Three Kinds of Data Breach?

There are three main types of data breaches, based on how they affect data:

• Confidentiality breach. Someone gains unauthorised access to data and discloses it to people who shouldn’t see it.
• Integrity breach. Someone alters or destroys data without authorisation.
• Availability breach. Authorised users are prevented from accessing data they need — for example, through a ransomware attack.

Conclusion

Data breaches are a serious and growing threat to Australian businesses. The increasing frequency of attacks — and the scale of recent high-profile incidents — makes it clear that no business is too small to be targeted.

Businesses have a legal and ethical responsibility to protect the sensitive information they hold. This means having the right security controls in place and knowing how to respond if something goes wrong.

Even with the best preventative measures, incidents can still occur. When they do, a fast, well-organised response can make all the difference. Contact us if you need help protecting your business or responding to a cyber incident.