A data breach is any event where information your business holds is accessed, taken or exposed to someone who should not have it — an outside attacker, a misconfigured cloud folder, or a staff member emailing a client list to a personal address. In 2026 the entry points are overwhelmingly ordinary: a phishing email that harvests a password, a laptop left in a car, a vendor whose systems were already compromised. The Australian Information Commissioner received 595 notifiable data breach reports between January and June 2025, and malicious attacks caused 67% of them (OAIC Notifiable Data Breaches report). This guide explains what counts as a breach, what Australian law requires you to do about one, and the practical steps that keep your business out of those statistics.
TL;DR
- A data breach is unauthorised access to, or exposure of, information your business holds.
- Most breaches start with people, not code: stolen passwords, phishing, and mistakes with email or cloud sharing.
- If a breach is likely to cause serious harm, Australian law requires notifying affected people and the OAIC within 30 days.
- The first-hour response: contain, assess, notify, and fix the entry point.
- Prevention is cheaper than response — a trained team and a reviewed gap assessment close the common paths.
What counts as a data breach
The term covers three distinct events:
- Confidentiality breach. Someone sees data they should not — the classic hacked-database image, but also a payroll spreadsheet shared with the wrong client.
- Integrity breach. Data is altered without authorisation: invoice amounts changed, records edited, backups tampered with.
- Availability breach. Data is destroyed or locked away from you — ransomware is the everyday example, since it denies you access to your own files.
All three count under the Privacy Act's Notifiable Data Breaches scheme when they involve personal information and are likely to result in serious harm. The event does not need to be a cyber attack: a lost USB drive with client records on it is a data breach, and one the OAIC reports contain regularly.
How breaches actually happen to small businesses
| Entry point | How it runs | Typical window |
|---|---|---|
| Stolen credentials | Password reused from another site, or captured by phishing, then used to log into email or remote access | Minutes to hours |
| Ransomware | One infected attachment encrypts files and copies data first as leverage | Days before discovery |
| Misconfigured cloud storage | A document link set to "anyone with the link" exposes records for months | Weeks to months |
| Email mistakes | Tax file numbers or client lists sent to the wrong recipient | Instant |
| Third-party compromise | A vendor or software supplier is breached, and your data leaks through them | Unknown until notified |
The pattern to notice: four of the five paths run through people and process rather than exotic code. Verizon's 2025 Data Breach Investigations Report finds the human element involved in roughly six in ten breaches (Verizon 2025 DBIR) — which is why the defence that matters most is a trained team, not another appliance.
What Australian law requires
If your business is covered by the Privacy Act and a breach involves personal information likely to result in serious harm, the Notifiable Data Breaches scheme requires you to:
- Assess within 30 days. You have 30 days from becoming aware of a suspected breach to assess whether it is notifiable.
- Notify affected individuals. As soon as practicable, with recommendations for the steps they should take.
- Notify the OAIC. The Office of the Australian Information Commissioner receives the same statement.
- Document everything. Assessments, decisions not to notify, and remediation all belong in a written record.
Which businesses are covered, and what counts as "serious harm", has its own detail — the guide to what counts as a notifiable data breach in Australia works through the eligibility and the assessment test. Beyond legal duties, notification is also practical: people who learn about a breach from their bank, instead of from you, do not stay customers.
What to do in the first hour of a suspected breach
- Contain it. Disconnect affected devices, suspend the compromised account, revoke the exposed sharing link. Every hour open is more data out.
- Establish the facts. What data, whose data, how many people, what entry point. This determines whether the 30-day assessment clock even applies.
- Preserve evidence. Do not wipe machines or delete logs — responders and possibly regulators will need them.
- Report it. ReportCyber coordinates with police and banks, and your insurer almost certainly requires the report.
- Prepare the notification. If assessment says notifiable, the message to affected people should be plain about what happened and what they should do — no hedging, no jargon.
Prevention: closing the paths before they open
The controls that remove most breach risk at small-business scale are unglamorous:
- Multi-factor authentication on email, finance and remote access — the stolen-password path dies here.
- Monthly security awareness training with simulated phishing, so the click rate falls before the attacker arrives.
- Access reviews — staff hold only what their current role needs, and leavers lose access the same day.
- Patching on internet-facing systems, where the no-click attacks live.
- A gap assessment once or twice a year to check the whole set, not just the newest tool.
FAQ
What is a data breach in simple terms? Any event where information your business holds is seen, taken, altered or exposed to someone who should not have access — whether a hacker, a mistake or a lost device.
What is the difference between a data breach and a cyber attack? A cyber attack is one possible cause of a breach. A breach is the outcome — data exposed. Many notifiable breaches in Australia come from human error, not attacks.
Do I legally have to report a data breach in Australia? If you are covered by the Privacy Act and the breach involves personal information likely to cause serious harm, yes: notify affected individuals and the OAIC within 30 days of assessing the breach.
What should affected customers be told? What happened, what data was involved, what you have done, what steps they should take (password changes, bank monitoring), and a contact point for questions. Plain language beats legalese.
Can a small business recover from a data breach? Yes — speed and honesty decide it. Containment within hours, genuine notification, and visible fixes afterwards keep most customer relationships intact. Silence does the damage.
One last thing
Search your cloud drive for documents shared with the link "anyone with the link" today. Misconfigured sharing is one of the most common — and most preventable — causes of data exposure in small businesses, and fixing it takes minutes.