Every reported data breach in New Zealand & Australia — indexed, sourced, searchable.

IRD (tax file) numbers, Home addresses, Bank account details

NZ Privacy Commissioner (notified)

Reported

Information used to link participants to online hearings, 2022–2026

Not named (CSV says all relevant authorities were notified)

Reported

Names, email addresses and school locations (per the Education Minister, who said there was no evidence passwords, dates of birth or financial information were accessed), Names, email addresses, student ID numbers and messages among users (per Instructure, as reported)

None reported

Reported

Names, email addresses, phone numbers and residential addresses; MIFF said no credit-card information or account passwords were accessed, and that the dataset does not include purchase history, booking totals or membership details

OAIC and ACSC (notified)

Reported

youX confirmed only that personal information was accessed and downloaded. The attacker claimed the data includes home addresses, income and debt details, government IDs (including about 5,010 driver-licence numbers in a preview), broker-customer SMS, vehicle identifiers, 8,075 employee password hashes and financial-hardship notes (unverified threat-actor claims)

OAIC and National Office of Cyber Security (reviews closed per youX, Apr 2026)

Reported

Some client documents, Passport scans (employee & client), as reported from material the group published, Internal firm information

NZ Privacy Commissioner (notified)

Reported

Personal and policy information that Prosura said may have been involved: contact details, travel destinations, billing/pricing information and policy dates (initial assessment), Claim data that Prosura said may have been compromised, including driver's licences and related images

OAIC and ACSC (notified)

Reported

Names, email addresses, GPS coordinates, some phone numbers, public forum posts and direct member messages; login details reportedly not included

NZ Privacy Commissioner (notified)

Reported

Current and former staff and affiliates: names, dates of birth, phone numbers, home addresses, job titles and employment dates, Alumni and students from 2010–2019 datasets

NSW Privacy Commissioner (IPC NSW) (notified); ACSC, TEQSA and National Student Ombudsman also notified

Reported

Names, school-issued email addresses, encrypted passwords, school names and year levels of current and former students; the Department said dates of birth, home addresses and phone numbers were not exposed

OVIC (Victorian privacy regulator; investigation opened 22 Jan 2026)

Confirmed

Around 280,000 active iiNet email addresses and around 20,000 active landline numbers extracted; around 10,000 usernames, street addresses and phone numbers, and around 1,700 modem set-up passwords, accessed. TPG said no ID documents or card/bank details were held in the system

OAIC (notified)

Reported

Not confirmed by Metricon. The Qilin ransomware group claimed to have stolen employee details, finance/HR documents and credit-card receipts (an unverified threat-actor claim)

OAIC and ACSC (notified)

Reported

About 4 million records: names, phone numbers, email addresses and Frequent Flyer details, About 1.7 million of those records also included one or more of address, date of birth, gender and meal preferences, Passwords and PINs not compromised

OAIC (preliminary inquiries closed; no regulatory action)

Confirmed

Details of 34M+ online orders, Records of 5,000+ current and former employees

None reported

Reported

Member account access via credential stuffing. Per-fund figures as reported: Rest said about 8,000 members may have had personal information accessed (~20,000 accounts affected); AustralianSuper said up to 600 members' passwords were used; Insignia ~100 accounts; ART 'several hundreds', Funds withdrawn: SBS News reported it understands four AustralianSuper members lost a combined ~A$500,000 (not confirmed by the fund)

ASIC / APRA (engaged)

Reported

Employee records and the credit-card details of a small number of guests, Attacker claim (Akira ransomware group): more than 148 GB including driver licences, passports, other employee and customer documents, financial data, NDAs and contracts

OAIC (notified)

Reported

Full names, email and residential addresses, mobile numbers, employer/role, and in some cases health information, schooling, religion and photographs

OAIC (notified)

Reported

Names, email addresses, phone numbers and physical addresses (marketing data held on a third-party platform)

None reported

Reported

Per the company, the data 'may include' names, account email addresses, account passwords, mobile numbers, delivery addresses and credit-card details

OAIC and ACSC (notified)

Reported

Some data taken from part of the IT network (the company said; data types not confirmed), The Medusa group claimed the data includes employee wage declarations and passport and driver's licence scans (possibly of contractors)

OAIC and ACSC (notified)

Reported

Name, date of birth, and passport or driver-licence ID numbers (held by a third-party ID-verification onboarding system); Squirrel said photos of IDs, usernames, passwords and bank account details were not compromised

NZ Privacy Commissioner (notified)

Reported

Names, contact details, dates of birth, copies of identity documents (passports, birth certificates, driver licences, citizenship/residence/visa documents) and financial information including card and bank account numbers

NZ Privacy Commissioner and NCSC (notified)

Reported

Facial-recognition biometrics and driver licence scans (claimed by the leak site; unverified), Signatures, home addresses and dates of birth (claimed by the leak site; unverified), Club membership and gaming-machine usage data (claimed by the leak site; unverified)

None reported (NSW Police investigating; OAIC involvement not sourced)

Reported

Names, contact details and, per Ticketmaster's notification, encrypted card numbers and expiry dates (scope for Australian customers not confirmed; ID Support NSW said payment information was not believed to be affected)

None confirmed in cited sources

Reported

Name, date of birth, address, email and phone number, External bank account details (BSB and account number) and driver licence number

Not specified (relevant authorities engaged)

Reported

Name, date of birth, gender, postal address/postcode, email and phone number; in some cases images or videos submitted with competition entries. MediaWorks said no passwords, ID documents or financial data were involved

NZ Privacy Commissioner (notified)

Reported

Home Affairs Free Translating Service client data: full names, dates of birth, mobile and email; visa, driver-licence and passport data (confirmed by the affected client organisation, not ZircoDATA), Archived Monash Health records from its family-violence and sexual-assault support units, 1970–1993 (confirmed by the affected client organisation, not ZircoDATA), Melbourne Polytechnic: about 60,000 students' low-risk identity attributes

OAIC and ACSC (notified); OVIC for Victorian public-sector clients

Reported

Full names, emails, phone numbers, delivery addresses and some dates of birth; the company said no payment-card data was stored or exposed

OAIC, ACSC, NZ Privacy Commissioner and CERT NZ (company said it was notifying)

Reported

Government ID for up to ~10% of those affected (approx. 4,000 Medicare cards, 7,500 driver licences, 220 passports, 1,300 tax file numbers); for ~90%, other personal information such as loan transaction statements, employment/salary details and dates of birth

None confirmed in cited sources

Reported

Audio-visual recordings of court hearings (1 Nov to 21 Dec 2023, with some earlier) stored on the in-court AV network

None reported

Reported

Full name, date of birth, gender and address/postcode of NDIS participants (some of whom were minors at the time)

None reported (investigated by the NDIA-led Fraud Fusion Taskforce; prosecuted in the NSW District Court, Parramatta)

Reported

Personal information of current and former employees

OAIC (notified)

Reported

Names, delivery addresses and delivery instructions, email addresses and phone numbers; for online accounts, masked (not full) credit-card data and one-way-encrypted passwords

OAIC (notified)

Reported

Contact details, date of birth, student/staff ID, nationality/citizenship, gender, ethnicity, employment/payroll information, bank account details, tax file numbers, driver licence/passport details, visa information, complaint, health/disability and legal information (per the Oct 2025 statement)

IPC NSW (notified)

Reported

Names, dates of birth, email and postal addresses, phone numbers, gender and membership details; Dymocks said it does not store financial data

OAIC (representative complaint accepted 28 May 2024)

Confirmed

Legal and government client documents; personal information of individuals, Data linked to 65 Australian Government entities (per the National Cyber Security Coordinator)

OAIC (investigation opened Feb 2024)

Confirmed

Names, addresses, invoices and bank account numbers, Children's names, homerooms and year levels; dates of birth for some TasTAFE students

None reported

Reported

Driver licence numbers (~7.9M across AU & NZ), Passport numbers (~53,000), Financial statements of fewer than 100 customers

OAIC + NZ Privacy Commissioner (joint)

Confirmed

Personal information in files on an internal storage drive, including bank account numbers and, for 3,820 people, tax file numbers; affected people were mostly current and former staff. QUT said its HR, student and financial systems were not accessed

Relevant Queensland and federal authorities notified

Reported

Ministry of Justice: ~14,500 coronial files on the transport of deceased people (Nov 2018–Nov 2022) and ~4,000 post-mortem reports (Mar 2020–Nov 2022), Te Whatu Ora: ~8,500 Middlemore bereavement records, ~5,500 cardiac/inherited-disease registry records, and records of six health regulatory boards (access blocked; no evidence at the time that they were downloaded)

NZ Privacy Commissioner (compliance investigation commenced Dec 2022)

Confirmed

Names, email addresses, phone numbers and delivery addresses; about 1.2 million of the ~2.2 million affected customers had only their email address exposed, Dates of birth

OAIC (notified)

Reported

Names, addresses, bank details and signatures, Photo identification of prospective renters

OAIC (notified)

Reported

Names, gender, dates of birth, contact information and some financial information (per the OAIC; reported as sales and invoice histories). Vinomofo says no passwords, ID documents or card/bank details were involved

OAIC — Privacy Commissioner determination (breach of APP 11.1)

Confirmed

Names, dates of birth, phone numbers, email addresses, home addresses, Driver licence, passport and Medicare numbers, birth/marriage certificate details and armed forces/police ID (subset of customers)

OAIC

Confirmed

Names, dates of birth, gender, Medicare numbers, addresses, email addresses, phone numbers and visa details (as described by the OAIC), Health claims data (subset of customers, as described by the OAIC)

OAIC

Confirmed

Names, student ID numbers, mobile numbers, university email addresses and recent unit results; 9,997 people then received scam SMS messages

OVIC (Deakin said it would notify)

Reported

Names, addresses and phone numbers of customers who had paid for unlisted (silent) numbers

ACMA (remedial direction)

Confirmed

Name, date of birth and home address, Tax file number and bank account details, Remuneration, tax withheld and superannuation details

South Australian Government (OAIC involvement not sourced)

Reported

Names, addresses and contact details (phone/email), For older records, expired credit-card numbers held on a legacy system

NZ Privacy Commissioner (notified)

Reported

Names, tier status and Airpoints membership numbers (not passwords, card details, itineraries, passport numbers or contact details)

None reported

Reported

Driver-licence information, names, email and residential addresses and contact numbers

Cyber Security NSW

Reported

Commercially and personally sensitive information held in a third-party file-transfer service

NZ Privacy Commissioner (compliance notice issued Sept 2021; closed Sept 2022)

Confirmed

Personal information of past and present employees, Details of commercial agreements with current and former enterprise customers

None reported

Reported

Personal information contained in 47 staff email accounts (~730 GB, ~3.8M documents)

IPC NSW (informed); NSW Audit Office performance audit (Dec 2020)

Reported

Names, email and home addresses, and hashed (bcrypt) passwords

None reported

Reported

Names, addresses, email addresses, age, customer and account numbers, and account balances; the bank said its core banking system (passwords, card details) was isolated from the affected CRM, and that the CRM did not hold driver licence, passport or tax file numbers, or dates of birth

WA Police / federal authorities

Reported

Usernames, names, email addresses and city/country; bcrypt-hashed passwords for a subset of users (~61M reported)

None reported

Reported

Property-valuation records containing borrowers' and owners' personal contact details; about 137,500 valuation records exposed and later leaked on a dark-web forum

None reported (criminal charges by NSW Police)

Reported

Names, home addresses, dates of birth, phone numbers, personal emails, emergency contacts, tax file numbers, passport details, payroll and bank account details (per ANU's June 2019 disclosure as reported); credit card, medical and research data not affected

None reported (public incident report)

Reported

Job-applicant personal details and reference contact information, and PageUp employee usernames/passwords (hashed and salted); PageUp said tax file numbers and financial/bank details were not affected

OAIC and ACSC / CERT Australia (notified)

Reported