Source: https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-statistics/notifiable-data-breaches-quarterly-statistics-report-1-january-31-march-2019/
Timestamp: 2020-02-19 16:22:51
Document Index: 449676769

Matched Legal Cases: ['art 1', 'art 1', 'art 1', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 3', 'art 4', 'art 4', 'art 4', 'art 1', 'art 1', 'art 1', 'art 1', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 4', 'art 4', 'art 4']

Notifiable Data Breaches Statistics Report: 1 January to 31 March 2019 — OAIC
Notifiable Data Breaches Statistics Report: 1 January to 31 March 2019
215 notifications
35% human error
61% malicious or criminal attacks
Please note, from July 2019 the OAIC will report every six months on notifications received under the NDB scheme.
Notifications received from all sectors
Chart 1.1 — Number of data breaches reported under the NDB scheme by month — All sectors
Table 1.A — Number of data breaches reported under the NDB scheme by quarter — All sectors
Number of individuals affected by data breaches — All sectors
Chart 1.2 — Number of individuals affected by data breaches during the quarter — All sectors
Note: Where bands are not shown (for example, 500 001 – 1 000 000) there were nil reports in the period. ‘Unknown’ includes notifications by entities whose investigations were ongoing at the time of this report. For the band 10,000,001 or more, this figure reflects the number of individuals worldwide whose personal information was compromised in this data breach, not only individuals in Australia, as estimated by the notifying entity.
The majority of data breaches in the period involved the personal information of 100 individuals or fewer (68 per cent of data breaches).
Data breaches impacting between one and 10 individuals comprised 50 per cent of the notifications.
Kind of personal information involved in data breaches — All sectors
Chart 1.3 — Kind of personal information involved in data breaches by number of notifications — All sectors
Table 1.B — Kind of personal information involved in data breaches by percentage of notifications – All sectors
NDBs received (%)
The definitions for the above kinds of personal information are contained in the Glossary.
Source of data breaches — All sectors
This chart breaks down the sources of data breaches as identified by notifying entities.
Malicious or criminal attacks accounted for 131 data breaches this quarter, while human error accounted for 75 data breaches. System faults accounted for nine data breaches. Malicious or criminal attacks differ from human error breaches in that they are deliberately crafted to exploit known vulnerabilities for financial or other gain. Many incidents in this quarter appear to have exploited vulnerabilities involving a human factor, such as clicking on a phishing email or by using social engineering or impersonation to obtain access to personal information fraudulently.
This chart shows the types of data breaches identified as ‘human error’ during the quarter.
The second largest source of data breaches was human error, such as sending personal information to the wrong recipient via email (31 per cent), loss of paperwork or storage device (16 per cent) as well as the unintended release or publication of personal information (28 per cent).
Certain kinds of data breaches can affect larger numbers of people. For example, in this quarter data breaches involving human error resulting in the unintended release or publication of personal information impacted the largest numbers of people (an average of 36,993 affected individuals per data breach). This is consistent with the previous quarterly trend. Failure to use BCC when sending emails impacted an average of 432 individuals per data breach.
Average number of affected individuals
This chart shows the types of data breaches identified as ‘malicious or criminal attack’ during the quarter.
Malicious or criminal attacks were the largest source of data breaches this quarter, accounting for 61 per cent of all data breaches. Of these 131 data breaches, 66 per cent involved cyber incidents such as phishing, malware or ransomware, brute-force attacks, compromised or stolen credentials.
Theft of paperwork or data storage devices was another source of malicious or criminal attacks (14 per cent). Other sources included actions taken by a rogue employee or insider threat (15 per cent), as well as social engineering or impersonation (5 per cent).
This chart breaks down the kinds of breaches identified as ‘malicious or criminal attack - cyber incident’ during the quarter.
The majority of cyber incidents were linked to the compromise of credentials through phishing (28 notifications), unknown methods (33 notifications) or by brute-force attack (six notifications).
This chart shows the types of breaches identified as ‘system fault’ during the quarter.
System faults accounted for four per cent of data breaches this quarter. The majority involved a system fault resulting in the unintended release or publication of personal information. This may include the disclosure of personal information on a website due to a bug in the web code, or a machine fault that results in a document containing personal information being sent to the wrong person.
Comparison of top five sectors that reported data breaches in the quarter
This section compares notifications made under the NDB scheme by the five sectors that made the most notifications during the quarter (top five sectors).
Table 2.A — Top five sectors by notifications in the quarter
Health service providers[1]
Finance (including superannuation)[2]
The NDB scheme applies to agencies and organisations that the Privacy Act 1988 (Cth) (Privacy Act) requires to take reasonable steps to secure personal information. This includes Australian Government agencies, businesses and not-for-profit organisations with an annual turnover of $3 million or more, credit reporting bodies, health service providers, and tax file number (TFN) recipients, among others.
From January to March 2019, the top sector to report data breaches under the NDB scheme was the private health service provider sector (health sector) (27 per cent). The second largest source of NDBs was the finance sector (13 per cent). This was followed by the legal, accounting and management services sector (11 per cent), the private education sector (education) (9 per cent), and the retail sector (5 per cent).
Source of data breaches — Top five sectors
This chart shows the sources of data breaches as identified by notifying entities in the top five sectors during the quarter.
Chart 2.1 — Source of data breaches — Top five sectors
The highest reporting sector this quarter was the health sector (58 notifications). Of those notifications, 52 per cent of data breaches resulted from human error. In contrast, notifications from the second highest reporting sector, finance, indicated that 59 per cent of its data breaches resulted from malicious or criminal attacks.
The legal, accounting and management services sector and the retail sector also reported the majority of data breaches resulted from malicious or criminal attacks.
Of the top five sectors, only the health and education sectors notified a data breach resulting from a system fault.
Human error data breaches — Top five sectors
This chart breaks down the kinds of breaches identified as ‘human error’ by the top five sectors during the quarter.
Chart 2.2 — Human error breakdown — Top five sectors
Malicious or criminal attack breaches — Top five sectors
This chart shows the types of data breaches identified as ‘malicious or criminal attack’ by the top five sectors during the quarter.
Chart 2.3 — Malicious or criminal attacks breakdown — Top five sectors
Cyber incident data breaches — Top five sectors
This chart shows the types of breaches identified as ‘malicious or criminal attack — cyber incident’ by the top five sectors during the quarter.
Chart 2.4 — Cyber incident breakdown — Top five sectors
In line with the overall trend, the majority of cyber incidents reported by the top five sectors were linked to the compromise of credentials through phishing, brute-force attacks or by unknown methods (33 notifications overall).
System fault data breaches — Top five sectors
This chart breaks down the types of data breaches identified as ‘system fault’ by the top five sectors during the quarter.
Chart 2.5 — System fault breakdown — Top five sectors
The finance sector, the legal, accounting and management services sector and the retail sector did not report any data breaches resulting from a system fault.
Finance (including superannuation) sector report
This section captures notifications made under the NDB scheme by entities in the finance sector, such as: banks, wealth managers, financial advisors, superannuation funds and consumer credit providers (regardless of annual turnover).
Number of data breaches reported under the NDB Scheme — Finance sector
Table 3.A — Number of data breaches reported under the NDB scheme by the finance sector by quarter
Number of individuals affected by data breaches — Finance sector
Chart 3.1 — Number of individuals affected by data breaches during the quarter — Finance sector
Note: Where bands are not shown there were nil reports in the period.
Most finance sector notifications in the period involved the personal information of 100 individuals or fewer (74 per cent of data breaches). Data breaches affecting between one and 10 individuals comprised 59 per cent of the notifications.
Source of data breaches — Finance sector
Malicious or criminal attacks were the cause of most notifications from the finance sector this quarter (16 notifications). This includes cyber incidents, such as using a phishing email to obtain credentials or the hacking of systems or networks. These attacks may also include a rogue employee improperly accessing or disclosing personal information.
Human error was the source of 11 notifications from the finance sector, such as personal information sent to the wrong recipient, loss of paperwork or data storage device, or the unauthorised release or publication of personal information.
This chart shows the types of data breaches identified as ‘human error’ by the finance sector during the quarter.
Human error was the second largest source of data breaches from the finance sector. Examples include sending correspondence containing personal information to the wrong recipient by email (36 per cent of human error notifications) and disclosing personal information through an unintended release or publication (27 per cent).
This chart shows the types of data breaches identified as ‘malicious or criminal attack’ by the finance sector during the quarter.
Malicious and criminal attacks were the leading cause of data breaches notified by the finance sector (59 per cent). Of these, cyber incidents were the most common type of attack (50 per cent), followed by theft of paperwork or data storage device (31 per cent), and rogue employees or insider threats (19 per cent).
This chart shows the types of data breaches identified as ‘malicious or criminal attack — cyber incident’ by the finance sector during the quarter.
The majority of cyber incidents reported by the finance sector were related to compromised or stolen credentials, through phishing (two notifications) or unknown methods (three notifications). Hacked websites or systems, malware and ransomware were each responsible for one notification.
System fault was not identified as the source of any data breaches notified by the finance sector during the quarter.
This section captures notifications made under the NDB scheme by entities in the health sector.
52% human error
45% malicious or criminal attacks
Number of data breaches reported under the NDB scheme — Health sector
Table 4.A — Number of data breaches reported under the NDB scheme by the health sector by quarter
Number of individuals affected by data breaches — Health sector
Chart 4.1 — Number of individuals affected by data breaches during the quarter — Health sector
Most health sector notifications in the period involved the personal information of 100 individuals or fewer (78 per cent of breaches). Data breaches affecting between one and 10 individuals comprised 60 per cent of the notifications.
Human error was the leading source of notifications in the health sector (30 notifications). This includes communications sent to the wrong recipient, unintended release or publication of personal information, or loss of paperwork or a data storage device.
Malicious or criminal attacks were the source of 26 health sector data breaches, with system fault accounting for two data breaches.
This chart shows the types of data breaches identified as ‘human error’ by the health sector during the quarter.
The largest source of data breaches in the health sector was human error (52 per cent), with examples including sending personal information to the wrong recipient by email (20 per cent of human error data breaches) or mail (23 per cent), unintended release or publication of personal information (20 per cent) or loss of paperwork or data storage device (23 per cent).
This chart shows the types of data breaches identified as ‘malicious or criminal attack’ by the health sector during the quarter.
Malicious and criminal attacks were the second largest source of data breaches from the health sector this quarter. Cyber incidents were the most common type of attack, accounting for 58 per cent, while the actions of a rogue employee or insider threat was the second most common type of attack (23 per cent).
This chart shows the types of data breaches identified as ‘malicious or criminal attack — cyber incident’ by the health sector during the quarter.
The health sector reported that six data breaches caused by cyber incidents were the result of compromised credentials through unknown methods. Phishing accounted for three notifications, followed by malware and hacking attacks (two notifications each). Brute-force and ransomware attacks were the source of one notification each.
Chart 4.6 — System fault breakdown — Health sector
Chart 4.6: Long text description
System faults account for two notifications from the health sector this quarter.
An unintended action by an individual directly resulting in a data breach, for example an inadvertent disclosure caused by sending a document containing personal information to the incorrect recipient.
Personal information sent to the wrong recipient via postal mail, for example, as a result of transcribing error or wrong address on files.
Sending an email to a group by including all recipient email addresses in the ‘To’ or ‘CC’ field, thereby disclosing all recipient email address to all recipients.
Loss of a physical asset(s) containing personal information, for example, leaving a folder or a laptop on a bus.
Failure to remove effectively or de-identify personal information from a record before disclosing it.
An attack that relies heavily on human interaction to manipulate people into breaking normal security procedures and best practices in order to gain access to systems, networks or physical locations.
A cyber incident targets computer information systems, infrastructures, computer networks, or personal computer devices.
Software which is specifically designed to disrupt, damage, or gain unauthorised access to a computer system.
Information relating to an individual’s finances, for example, bank account or credit card numbers.
An individual’s personal reference number in the tax and superannuation systems, issued by the Australian Taxation Office.
Information that is used to confirm an individual’s identity, such as a passport number, driver’s licence number or other government identifier.
Information that is used to contact an individual, for example: home address, phone number or email address.
As defined in section 6FA of the Privacy Act.
Sensitive information, other than health information, as defined in section 6(1) of the Privacy Act. For example: sexual orientation, political or religious views.
Chart 1.1 is a bar chart showing the number of data breaches reported under the Notifiable Data Breaches scheme by month, from January 2019 to March 2019.
Chart 1.2 is a bar chart showing the number of affected individuals. Where bands are not shown (for example, 500,001 to 1,000,000), there were nil reports in the period. ‘Unknown’ includes notifications by entities whose investigations were ongoing at the time of this report.
10,000,001 or more 1
250,001–500,000 1
100,001–250,000 1
50,001–100,000 1
10,001–25,000 2
5,001–10,000 3
1,001–5,000 12
101–1,000 42
11–100 39
2–10 43
Contact information 186
Financial details 98
Identity information 55
Tax file number 36
Other sensitive information 25
Malicious or criminal attack: 61%
System fault: 4%
Unauthorised disclosure (verbal) 3
Unauthorised disclosure (unintended release or) publication 21
Unauthorised disclosure (failure to redact) 3
PI sent to wrong recipient (other) 2
PI sent to wrong recipient (mail) 9
PI sent to wrong recipient (email) 23
Loss of paperwork / data storage device 12
Failure to use BCC when sending email 2
Chart 1.6 is a bar chart that breaks down the kinds of data breaches identified as ‘malicious or criminal attack’ in the quarter by number of notifications.
Theft of paperwork or data storage device 18
Rogue employee/insider threat 19
Cyber incident 87
Chart 1.7 is a pie chart that breaks down the kinds of data breaches identified as ‘malicious or criminal attack — cyber incident’ in the quarter by percentage.
Compromised or stolen credentials (method unknown) 40%
Phishing (compromised credentials) 20%
Malware 13%
Brute-force attack (compromised credentials) 7%
Ransomware 7%
Unintended release or publication: 6
Unintended access: 3
Chart 2.1 is a bar chart that breaks down the sources of data breaches as identified by notifying entities in the top five sectors in the quarter, by number of notifications. From least to most total notifications:
Chart 2.2 is a bar chart that breaks down the kinds of data breaches identified as ‘human error’ by the top five sectors in the quarter, by number of notifications.
Loss of paperwork / data storage device
7 6 7 2 0 6 2
2 4 0 0 1 3 1
1 4 0 0 1 4 0
Chart 2.3 is a bar chart that breaks down the kinds of data breaches identified as ‘malicious or criminal attack’ by the top five sectors in the quarter.
Chart 2.4 is a bar chart that breaks down the kinds of data breaches identified as ‘malicious or criminal attack — cyber incident’ by the top five sectors in the quarter.
2 0 0 4 0 2 2
0 1 0 5 2 1 0
2 1 2 6 3 1 0
Chart 2.5 is a bar chart that breaks down the kinds of data breaches identified as ‘system fault’ by the top five sectors in the quarter. The Health service providers and Education sectors each reported one unintended release or publication. The Health service providers sector also reported one unintended access.
250,001 to 500,000 1
101 to ,000 4
11 to 100 4
2 to10 8
Human error: 41%
Loss of paperwork / data storage device 2
Theft of paperwork or data storage device 5
Cyber incident 8
Phishing (compromised credentials): 25%
Compromised or stolen credentials (method unknown): 37.5%
Malware: 12.5%
Ransomware: 12.5%
Hacking: 12.5%
1,001 to 5,000 3
101 to 1,000 8
11 to 100 10
2 to 10 11
Human error: 52%
Malicious or criminal attack: 45%
Unauthorised disclosure (unintended release or publication) 6
PI sent to wrong recipient (mail) 7
Loss of paperwork / data storage device 7
Rogue employee/insider threat 6
Cyber incident 15
Chart 4.6 — System fault data breaches — Health sector
Chart 4.6 is a bar chart that breaks down the kinds of data breaches identified as ‘system fault’ by the health sector in the quarter. There was one unintended release or publication, and one unintended access.
Back to Chart 4.6