Canva
Canva — Third-party compromise disclosed October 2026
- New incident
- Third-party compromise
- Reported
- Disclosure date
- 19 October 2026
- People affected
- Not stated
- Main categories of affected data
- Not stated
- Official sources
- 1
Breach Watch
A record of Australian data breaches, compiled from official notices published by the organisations and regulators involved.
Every fact on every record is checked against a quoted passage in a named source document by a person, and anything a source does not establish is shown as unconfirmed rather than left out.
OFX Group
OFX Group — Data breach disclosed October 2026
- New incident
- Not stated
- Independently corroborated
- Disclosure date
- 16 October 2026
- People affected
- Not stated
- Main categories of affected data
- Not stated
- Official sources
- 3
Icon Oncology Group
Icon Oncology Group — Third-party compromise disclosed October 2026
- New incident
- Third-party compromise
- Reported
- Disclosure date
- 12 October 2026
- People affected
- 31,000, estimated by the source
- Main categories of affected data
- patient names, addresses, diagnoses and Medicare details
- Official sources
- 1
ASOS
ASOS — Data breach
- New incident
- Not stated
- Reported
- Public record
- 26 November 2025
- People affected
- Not stated
- Main categories of affected data
- basic personal information, name and contact details
- Official sources
- 3
Services Australia
Services Australia — Exploited vulnerability disclosed September 2026
- New incident
- Exploited vulnerability
- Independently corroborated
- Disclosure date
- 24 September 2026
- People affected
- 0, stated by the source
- Main categories of affected data
- medical statistics
- Official sources
- 14
Latitude
Latitude — Data breach disclosed September 2026
- Update to a previously disclosed incident
- Not stated
- Officially confirmed
- Disclosure date
- 25 September 2026
- People affected
- 225,000, stated by the source
- Main categories of affected data
- Not stated
- Official sources
- 3
Quest Hotels
Quest Hotels — Exploited vulnerability
- Update to a previously disclosed incident
- Exploited vulnerability
- Reported
- Public record
- 22 September 2026
- People affected
- 1,991,613, estimated by the source
- Main categories of affected data
- Not stated
- Official sources
- 1
Sunraysia Community Health Services
Sunraysia Community Health Services — Third-party compromise disclosed September 2026
- New incident
- Third-party compromise
- Reported
- Disclosure date
- 15 September 2026
- People affected
- Not stated
- Main categories of affected data
- private client information
- Official sources
- 1
SIA Medical Centre
SIA Medical Centre — Ransomware disclosed August 2026
- New incident
- Ransomware
- Reported
- Disclosure date
- 18 August 2026
- People affected
- 20,000, estimated by the source
- Main categories of affected data
- Not stated
- Official sources
- 1
Oz Hair & Beauty
Oz Hair & Beauty — Third-party compromise disclosed August 2026
- New incident
- Third-party compromise
- Independently corroborated
- Disclosure date
- 24 August 2026
- People affected
- Not stated
- Main categories of affected data
- Not stated
- Official sources
- 2
