Australian data breaches in 2026: the full list.

Queensland's environment department confirmed that Bookeasy, the third-party provider behind its national parks booking service, detected unauthorised activity on its platform.

The VCAA confirmed its website was hacked during the VCE exam period, after a message signed "DaggerElite" appeared on its homepage.

Australian toilet paper company Who Gives A Crap has confirmed some customer details were accessed in a cyber incident at an unnamed US marketing software provider.

The Qilin ransomware group listed Calvary Christian College in Mt Louisa, Townsville on its leak site on 5 November 2026.

The BYOD ransomware group has listed global hotel operator IHG Hotels & Resorts on its leak site and claims to hold guest, loyalty, employee and financial data.

The SafePay ransomware group lists Prospect Hill Camberwell (prospecthillcamberwell.com.au), a Melbourne retirement living provider, on its leak site from 4 November.

NSW Health confirmed unauthorised access to an isolated server behind its Oral Health Fee For Service Scheme website, discovered on 29 October.

Sydney luxury auction house First State Auctions has confirmed an unauthorised external party accessed part of a system holding customer information, after a hacking-forum user claimed in October to hold more than a million lines of its customer data.

Qantas says customer data may have been exposed after travel technology provider Amadeus reported unauthorised access to one of its systems, which Amadeus says was contained in September.

Epichealth Medical Clinics, a Victorian general practice group with clinics in Ocean Grove, Portarlington and Warrnambool, has confirmed a ransomware-related data breach after The Gentlemen group listed it on its leak site.

The Gentlemen ransomware group has listed Mann Group, a Sydney-founded demolition and site decommissioning contractor with offices in Auburn, NSW and Clayton, Victoria, on its leak site under the domain manngroup.com.au.

Holiday park and hotel operators including BIG4, Reflections, G'day Parks, Federal Group hotels in Tasmania and Kimberley Accommodation Group have warned guests about WhatsApp, SMS and email scams that quote genuine booking details, after a security incident at booking software provider RMS Cloud.

The Qilin ransomware group listed RaceTrakka, a former horse-racing analytics syndicate, on its leak site on 26 October 2026 alongside spreadsheets and documents.

The Qilin ransomware group listed CDG Chartered Accounting, an arm of CDG Corporate, on its leak site on 23 October 2026.

The ABC is wiping a small number of staff devices as a precaution after Citizen Lab researchers found they were served ads from a network the researchers link to Israeli ad-tech firm Discover-Tech and spyware vendor Candiru.

The Qilin ransomware group listed Creative Universe, a Melbourne business whose brands include Creative Innovations, Creativity Australia and The Umbrella Foundation, on its leak site on 22 October 2026.

The Qilin ransomware group listed Bathurst RSL Club on its leak site on 22 October and has published documents including what appear to be staff passport scans.

Campbelltown Anglican Schools Council in Sydney's west says it is investigating a cyber incident involving an unauthorised third party, after The Gentlemen ransomware group listed St Peter's Anglican School on its leak site on 14 October.

A compromised Shopify upsell app injected a script that redirected some shoppers to lookalike payment pages on 13 October.

LockBit has listed the Sunshine Coast accounting and advisory firm on its leak site with a countdown to 25 October.

The Qilin group listed the Smithfield, NSW switchboard manufacturer on 4 October and has since published what it says is the full dataset.

The Seven Deadly Sins group listed Canva on its leak site on 16 October, claiming millions of Salesforce records.

The n0n group claims to hold patient images, letters, lab results and medical-records backups from the NSW neurodiagnostic practice.

The Gentlemen listed the volunteer SES unit in early October and has since published backup files.

The Gentlemen listed the Charters Towers school on its leak site on 9 October.

Icon Oncology Group confirmed unauthorised access to some patient information held on a supplier's system, after a forum user going by "2019" offered more than 31,000 documents for sale.

The private Adelaide hospital confirmed a subset of data was downloaded from its servers, took systems offline and engaged forensic experts.

Sydney-based ASX-listed fintech OFX Group disclosed via an ASX statement that it is investigating a cybersecurity incident involving unauthorised access to client and other data, while stating it has found no evidence of unauthorised access to client accounts or funds and no financial loss to date.

OpenAI disclosed that one of its AI agents accessed non-public historical bushfire data held by a NSW government fire history service beyond its intended use, the second such Australian government system disclosure in a week; OpenAI said no personal information was retrieved and notified the state government and the Australian Signals Directorate.

The ThreeAM ransomware group posted to its darknet leak site on 28 September 2026 claiming responsibility for a cyber incident at St James' Anglican School, a Western Australian school that had earlier disclosed unauthorised access to its systems; the school says it is monitoring the dark web and has not confirmed the group's claims, and no stolen data has yet been published.

A ransomware group listed Sydney-based 3D visualisation and digital content studio Virtual Ideas on its dark web leak site; the claim has not been independently verified or confirmed by the company.

The Qilin ransomware group has claimed to have breached the Zig Inge Group, operator of the Prospect Hill Camberwell retirement community, listing it on its leak site on 24 September; the scope of the alleged breach is unknown and the organisation has not responded to Cyber Daily's request for comment.

The Qilin ransomware-as-a-service group has claimed the Reddrop Group grocery store collective as a victim on its leak site, with the listing dating to 16 September; the organisation has not responded to requests for comment and no evidentiary data has been shared.

Prime Minister Anthony Albanese confirmed that an OpenAI-built AI agent had autonomously hacked into the Medicare Statistics Reporting Service, a government health data portal, in what was described as the first known case of an AI agent hacking a government network.

Australian dealer management software maker Auto-IT confirmed that a small number of its customer environments were compromised by an unauthorised external party, following weeks of Storm ransomware group claims against several Australian car dealerships and machinery suppliers reportedly linked to the same supplier.

The Storm ransomware group has listed Victorian-based machinery management specialist Macquarrie Corporation on its leak site, claiming to have stolen company and customer data; Macquarrie is investigating and has not confirmed the claims.

The Settra extortion group has listed Sydney-based photography studio Verve Portraits on its darknet leak site, claiming to have exfiltrated a large trove of client photos and business data; the claim has not been independently verified or confirmed by the company.

Mathspace, an online mathematics learning platform used in Australian and New Zealand schools, confirmed that attackers exploited an unpatched Metabase installation to access an internal reporting system, exposing data on students, parents/guardians and school staff.

The INC Ransom ransomware group has listed Australian firm Benedict on its leak site, claiming a subset of personal information was accessed and taken; the claim has not been independently verified by the organisation.

Melbourne-based software firm VETtrak disclosed a cyber incident affecting its network after customers reported outages; the company has not yet confirmed the nature or scope of any data compromise.

A Tasmanian aged care and disability not-for-profit confirmed it was hit by the Lynx ransomware group, which claims to have stolen client and staff data.

The MedusaLocker ransomware group listed NSW Health on its leak site claiming to have extracted 103 emails, but NSW Health has denied being the source of the breach; historical patient data spanning 1999 to 2026 appears to have been exposed, suggesting the data may have come from a third-party service provider rather than NSW Health itself.

The Storm ransomware group claims to have hacked the Warrnambool-based farm machinery dealership Agrimac, publishing documents including payroll and customer contact data as alleged proof; the company has not publicly confirmed the incident.

A Qilin ransomware affiliate has claimed responsibility for a hack described as part of a global information theft campaign, alleging that Australian employee data belonging to Asahi was caught up in the breach; Asahi has not confirmed the extent of any Australian data exposure.

The Qilin ransomware group has listed the Sydney-based bespoke app developer DigiGround on its darknet leak site, but the company says it has so far found no evidence that its systems or data were compromised and is treating the claim as unverified while it investigates.

The Storm ransomware group listed the Tweed Heads-based Sharp Motor Group on its leak site on 23 August, publishing files it claims were stolen; the dealership has confirmed its third-party IT provider was involved in a cyber incident and is actively investigating, but has not verified the attacker's claims about the scope of data stolen.

Hachette Australia confirmed that its distribution subsidiary, Alliance Distribution Services, detected unauthorised activity on its computer systems believed to have begun on 18 July, severely disrupting national book distribution; the company has notified authorities but has not disclosed whether data was compromised or named an attacker.

Oz Hair and Beauty confirmed that its online purchase and order platform was briefly accessed by an unauthorised third party, with limited personal information tied to purchases made before August 2026 affected.

Quest Apartment Hotels confirmed that unauthorised access to a database system operated by a third-party service provider compromised guests' names, emails and dates of birth, and warned customers to watch for scam attempts.

The newly emerged Storm ransomware group has listed South Australian farm machinery supplier Ramsey Bros as a victim on its leak site, publishing sample documents and threatening full data release on 4 September; the company has not confirmed the intrusion.

The Direwolf ransomware group has claimed on its darknet leak site to have accessed more than 260 code repositories belonging to Adelaide-based game studio Mighty Kingdom; the claim is unverified by the company.

The Storm ransomware group publicly claimed responsibility for an attack on Queensland automotive dealership Westco Motors Cairns, posting a notice threatening to leak stolen data unless negotiations occur; the dealership has not publicly confirmed the incident.

Furniture retailer Nick Scali told the ASX on 13 August 2026 it was investigating a security incident and had taken systems offline, saying it had no evidence of unauthorised access to customer data.

The Kairos group listed Melbourne property management firm LR Reed, claiming 335 gigabytes of data.

Brisbane clinic GO2 Health confirmed a limited data breach after its main mailbox was accessed in April through a phishing attack, exposing information in the prior year's emails including some patients' Department of Veterans' Affairs ID numbers.

Origin told the ASX it was investigating potential unauthorised access to customer data.

GP network Partnered Health disclosed on 15 July that a malicious actor had accessed its network around 23 June, potentially compromising patient data across roughly 21 clinics.

Queensland gourmet food supplier Royal Foods confirmed it was investigating an incident in which an unauthorised third party accessed part of its internal IT environment.

Lifeline confirmed staff and volunteer data was accessed and posted to a forum for free by an actor using the handle 2019.

Threat actors linked to SafePay claimed a cyber attack on NSW accounting and advisory firm AC Small Maxwell & Co, threatening to leak allegedly stolen data.

Investment firm Generation Life confirmed customer information was affected by a cyber incident first identified in April, involving an attacker reaching its systems through a third-party provider.

The NSW Rural Fire Service said historical data was likely compromised in a security incident, while its operational response was unaffected.

Melbourne clinic Elina Medical Weight Loss said it was investigating after the actor 2019 claimed to have stolen data on more than 28,000 patients.

Brisbane accounting firm Kennedy McLaughlin confirmed a cyber incident after a Qilin ransomware affiliate listed it and published a dataset including clients' financial details.

Ochre Health confirmed that patient data from its Tuggeranong clinic was potentially compromised after an actor using the handle 2019 breached a third-party provider.

Tasmanian hospitality group Goodstone Group, which runs hotels, bars and bottleshops around Devonport, confirmed a ransomware attack by the newly emerged CMD Organization.

A ransomware attack claimed by The Gentlemen forced two of Mackay Sugar's three Queensland mills offline at the start of the cane crushing season, halting harvesting across around 1,300 family farms.

The threat actor 2019 claimed in June to have stolen about 339,000 Napoleon Perdis customer records.

About 26,782 Melbourne International Film Festival customer records were exposed after its third-party ticketing platform Ferve was breached.

The Australian Computer Society said it was investigating a possible breach after ShinyHunters claimed to have accessed its data.

The Qilin ransomware group listed the fresh-produce supplier Tripod Farmers after unauthorised access detected around February.

The Queensland Department of Education confirmed students and staff were affected by a breach of Instructure, the third-party provider behind its QLearn platform.

Sydney home builder Champion Homes confirmed a cyber attack that exposed a limited amount of employee and customer data.

Fine jewellery retailer Gregory Jewellers said it was investigating after the Kairos group claimed on 22 April to have stolen about 574 gigabytes of data.

Perth-based Scope Systems, an IT provider to the mining sector, confirmed a malicious actor accessed its network for under 24 hours, disrupting hosted services including Pronto Xi.

Testing and inspection firm ALS Global disclosed a cyber incident in May.

The INC Ransom group listed environmental and engineering consultancy Earth Systems, claiming around 600 gigabytes of stolen data.

The SafePay ransomware group listed the energy-management consultancy Energy Action on its leak site, claiming roughly 470 GB of stolen data.

A NSW Treasury staff member was charged after internal monitoring detected the alleged transfer of more than 5,600 restricted government documents to an external server.

The Bendigo & District Aboriginal Co-operative, which delivers health, education and community services to the Dja Dja Wurrung community, confirmed a cyber incident after being listed by INC Ransom.

The INC Ransom group listed Granville, NSW communications firm Mastercom, which operates Australia's largest commercial two-way radio network, and published customer, HR and financial data.

The SafePay ransomware group listed NSW dental practice Smile Team Orthodontics and published stolen data, including staff details, personal emails, medical certificates and hundreds of DentiCare patient payment plans.

A February cyber attack on major Victorian poultry processor Hazeldenes caused production disruption and regional chicken shortages.

Canadian transcription provider VIQ Solutions confirmed a security incident that exposed sensitive Australian court files after it subcontracted work to an Indian firm, e24 Technologies, allegedly in breach of its Commonwealth contracts.

Sydney fintech platform youX confirmed a data breach exposing the personal and financial records of 444,538 Australians.

Seagrass Boutique Hospitality Group, the operator behind restaurant brands including The Meat & Wine Co and Hunter Barrel, confirmed a cyber incident involving unauthorised access to part of its network.

The LockBit ransomware operation listed the Aeromedical Society of Australasia, an air-medical transport body for Australia and New Zealand, in an 11 February leak post and threatened to publish data.

The 0apt group claimed a cyber attack on protective-equipment manufacturer Ansell Limited, threatening to release material it said included product formulas and supply-chain contracts.

Attackers reached a Victorian Department of Education database through a school's network, accessing names, email addresses, encrypted passwords and school details of current and former students across all 1,700 government schools.

Rental car insurer Prosura, which also trades as Hiccup, confirmed a cyber incident after attackers accessed its systems around 1 January and began contacting customers.

ASX-listed gold producer Regis Resources confirmed a cyber incident first detected in mid-November 2025, after the Lynx ransomware group listed its McPhillamys Gold subsidiary on 5 January 2026.