Optus, Medibank, Qantas: millions of Australians have had their personal information exposed in data breaches. Here’s what companies have to tell you, and the steps to take if your details are stolen.
A data breach happens when personal information held by an organisation is lost, accessed or shared without permission. It can result from a cyber attack, an employee mistake, or information being sent to the wrong person.
Australians have been hit by several huge breaches. In 2022, the personal details of about 9.5 million current and former Optus customers were exposed, including passport and driver’s licence numbers for many. Weeks later, Medibank was hit by a cyber attack exposing data on about 9.7 million people. In 2025, Qantas said a cyber attack had exposed information on about 5.7 million customers.
What companies must do
Under the Notifiable Data Breaches scheme, which started in 2018, organisations covered by the Privacy Act must notify affected people and the Office of the Australian Information Commissioner when a breach is likely to result in serious harm.
The notice should explain what happened, what information was involved, and what people should do.
Penalties for serious or repeated privacy breaches were increased in 2022 to up to $50 million, or more based on the benefit gained or the company’s turnover.
Steps to take
If you’re told your information has been exposed, the steps depend on what was taken.
If identity documents, such as a passport, driver’s licence or Medicare card, were exposed, contact the issuing agency about replacing them. Some states replace driver’s licences free of charge after major breaches.
Change passwords for any affected accounts, and for any other accounts that use the same password. Use a different password for every account, a password manager can help, and turn on multi-factor authentication.
Watch your bank statements for unusual transactions, and consider placing a ban on your credit report with the credit reporting bureaus, which stops anyone opening credit in your name for a period.
Beware follow-up scams
Breached data is often used in scams. Criminals may contact you pretending to be the company involved, the police or a government agency, using your real details to seem convincing.
Be suspicious of unexpected calls, texts and emails, especially those asking for money, passwords or one-time codes. Contact organisations using their official phone numbers, not details provided in a message.
Where to get help
IDCARE, Australia’s national identity and cyber support service, offers free help on 1800 595 160. The Australian Cyber Security Centre’s website has advice, and scams can be reported to Scamwatch.
If you believe an organisation mishandled your information, you can complain to it first, then to the Office of the Australian Information Commissioner.
