When criminals attack Australian health data, they get in 95 times out of 100
Health is Australia's most-breached sector in the worst breach year on record, and the attackers who come almost always get in.
Attackers who target Australian health organisations succeed almost twice as often as attackers targeting anyone else. The Australian Signals Directorate's incident data shows malicious actors were successful in 95% of the health-sector incidents its cyber security centre responded to in 2024-25, against about 52% across all sectors. The same report found ransomware attacks on the sector doubled in a year.
The sector also files more breach notifications than any other. In 2025, the worst year since Australia's mandatory reporting scheme began, health service providers reported 225 of the 1,205 notifications the national regulator received. Financial services and the entire Australian Government filed fewer.
The record year, counted by sector
The Office of the Australian Information Commissioner received 1,205 data breach notifications in calendar 2025, an 8% rise on 2024's 1,112. No year since the scheme commenced in 2018 has recorded more. Malicious or criminal activity caused 716 of them. Health service providers filed 225, 19% of the total. The lead is not a one-year spike: health topped the January to June 2025 reporting period too, at 18% of notifications.
One caution on what the number measures: the OAIC counts notifications, not victims. The scheme covers entities bound by the Privacy Act, which excludes most businesses under A$3 million turnover, so much of the primary care and aged care long tail sits outside the count.
Disruption of Australian healthcare networks can endanger patients, making the healthcare sector vulnerable to extortion by cybercriminals.
Why attackers succeed against health organisations
The Directorate's Annual Cyber Threat Report carries a dedicated in-focus section on healthcare, and the mechanism it describes is simple: disrupting an Australian healthcare network can endanger patients, which makes the sector unusually vulnerable to extortion. A hospital or a health fund cannot refuse to negotiate the way a retailer can. Health data is also valuable on dark-web forums in a way card numbers are not, because a medical record carries the identity material that fuels fraud and identity theft for years.
The scale of one health-data hoard shows what is at stake. In July 2024, the e-prescription provider MediSecure notified customers of a cyber security incident first detected that April. Attackers had exfiltrated about 6.5 terabytes from a MediSecure database server holding data back to March 2019: the personal and health information of approximately 12.9 million Australians.
What health data costs when it leaks
Healthcare has recorded the highest average data breach cost of any industry for over a decade. IBM's 2025 Cost of a Data Breach study put the healthcare average at USD 7.42 million per breach, the fourteenth consecutive year the industry topped the table. The 2026 study shows the figure falling to USD 6.64 million, and healthcare still the most expensive industry to breach. The figures are global averages from vendor research, but the direction matches the Australian data: the sector attackers succeed against most often is the sector whose data costs the most to lose.
The enforcement era reached health data first
For years, Australian privacy law carried penalties regulators rarely used. That has changed, and the health sector is at the front of the queue. In October 2025, the Federal Court ordered Australian Clinical Labs to pay A$5.8 million in civil penalties after a 2022 ransomware attack on the pathology company, the first civil penalty judgment in the Privacy Act's history. A$1.6 million of it was for failing to properly assess whether an eligible data breach had occurred and for failing to notify the regulator. Delay, the court established, is independently punishable.
The bigger case is still before the court. The Australian Information Commissioner's civil penalty proceedings against Medibank concern the 2022 breach that exposed the data of 9.7 million Australians, including their health claims data. The Commissioner alleges Medibank committed a separate contravention for each affected individual, a reading legal commentators note would make the maximum penalty astronomically high if the court accepted it.
The compliance bar is still rising. Privacy Act penalties already reach the greater of A$50 million, three times the benefit gained from the contravention, or 30% of a company's adjusted turnover. The second tranche of reforms, expected in 2026, would add a "fair and reasonable" test for handling personal information and remove the small-business exemption that keeps many smaller health practices outside the Act entirely.
Australian Clinical Labs wasn't fined for being attacked. It was fined for being slow to assess and slow to tell anyone. That distinction should change how every health fund rehearses its incident response.
Incident response plans are mandatory
Certification alone doesn't stop a breach. What it forces is a structured answer to three questions: what data you hold, who can reach it, and what happens the day something goes wrong. The third question is the incident response plan's job, and the ACL judgment shows what a slow answer costs: A$1.6 million of the penalty was for the assessment and the notification, not for the attack itself.
The evidence supports a short list for health organisations. Know exactly which systems hold health information, because a single database server held a decade of e-prescription data. Assume attackers will get in, because in this sector they usually do, and a rehearsed incident response plan is what turns a compromise into a managed event. Rehearse the notification decision too, because the regulator now penalises the delay itself.
The organisations that hold the most health data, health funds above all, are the ones the extortion model targets first. The data says they are right to treat security as an operating requirement the badge alone does not satisfy.
Airteam builds platforms for organisations whose members trust them with health data. If you want that architecture right from the start, get in touch.
About the data
Sources: OAIC Notifiable Data Breaches statistics for calendar 2025 (published 6 July 2026); ASD's ACSC Annual Cyber Threat Report 2024-25; IBM Cost of a Data Breach Reports 2025 and 2026. Every figure traces to its source in the research brief.