A data breach email is written to make you click first. Do the opposite.
This guide is a suggested practical order (not legal advice) on what to do after a data breach in Australia. It follows Australian Cyber Security Centre (ACSC) and OAIC guidance, and adds steps most government notices leave out. Prevention steps are in How to Protect Your Privacy in Australia (2026).
Quick answer
The Office of the Australian Information Commissioner (OAIC) has reported:
In January to June 2026 the OAIC received 667 notifications, up from 662 in the previous six months. Breaches affecting 100,000 to 250,000 people doubled from 3 to 6. Those affecting 500,000 to 1 million people rose from 0 to 3. (OAIC media release, 26 October 2026).
Some notices are genuine. Some are the scam that follows a genuine one.
1. Confirm it without the message
Open the organisation’s own website or use a number on a statement or the back of a card. Do not use the link or phone number inside the message.
2. Note what was exposed
Licence, email, address, Medicare number, tax file number, password, health file, or card details. If the notice is vague, ask through a number you already trust.
3. Use the ASCS tool
The Australian Government Have you been hacked? tool walks through money, email, accounts and identity based on what was taken.
4. Change the password on the real site
Log in through the real site or app, not the email. If that password was reused, change those accounts too. Each one gets a different password. Proton Pass, or other password manager, makes this practical.
5. Turn on two-factor authentication
An authenticator app or a passkey is better than a text message. Email first, because it resets everything else. Then banking and myGov.
Call the bank yourself on the number on the card or a statement. Ask them to flag fraud, freeze or replace the cards, and watch for a new payee or a changed phone number. Get a reference number.
If the bank’s response is poor, the Australian Financial Complaints Authority (AFCA) handles that complaint at no charge. Do not pay anyone who messages you offering to recover the money. That is likely a second scam.
A driver licence, passport, Medicare card, tax file number, or photo of these needs immediate attention.
A credit ban stops a lender seeing your file without your written permission. That makes a loan or a card in your name harder to open.
From 1 April 2026, Australia has two consumer credit bodies. Cover both:
The first ban is free and lasts 21 days. Extend it before day 21 ends. You can still order your own report while a ban is on. A ban does not close a fraudulent account that is already open. That is a bank and IDCARE job. You will need the ban lifted before you apply for credit yourself.
This is where people get hurt a second time.
An email asking you to upload a licence. A text code you did not request. A call from “the fraud team” asking you to read a code aloud. An offer to recover money for a fee.
Use only the official website, or a number you already have. If a code arrives that you did not trigger, someone may be trying to log in. Change the password from a device you trust, and check the list of signed-in devices.
If a covered organisation has an eligible data breach, it must notify the OAIC and the people affected as soon as practicable. There is no 72-hour deadline in Australian law to tell you. The organisation does have 30 days to assess a suspected eligible breach.
The notice should name the organisation, describe the breach, list the kinds of information, and recommend steps. If you were not told and you should have been, write to the organisation first. Then consider a written complaint to the OAIC. A breach is not automatically a legal failure. A careless one can be. That argument belongs with the OAIC.
Watch the bank feed, email forwarding rules, the recovery address, the myGov inbox, and new credit enquiries. Have I Been Pwned can show whether the same email is in a known public dump. It will not list every Australian corporate breach.
Report cybercrime through ReportCyber. That report can also support a later credit-ban extension. If you need a person to talk to – the Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371).
A breach is data that has already left. The next one is often the same password, the same inbox, and the same phone.
A stock phone keeps sending data in the background. A Privacy Phone does not undo this breach. It reduces what is sitting there for the next one. The same logic applies to a computer, especially an unsupported Windows 10 machine.
Sometimes the person is an ex-partner, a hidden app, or an account you do not fully control. That is a safety problem first. Call 000 if you are in danger. Otherwise 1800RESPECT on 1800 737 732, Lifeline on 13 11 14, 13YARN on 13 92 76, and eSafety. A hardened phone can sit inside a safety plan. It does not replace one. See DV Safe Phones in Australia.
Ignore the link. Open the real website yourself. Change the affected password and any reused password. Turn on two-factor authentication. Call the bank if money or cards were involved.
As soon as practicable, if the breach is eligible. There is no 72-hour deadline in Australian law to notify you. There is a 30-day period to assess a suspected breach.
Yes, if identity documents or financial data were exposed, or if someone may apply for credit in your name. Do Equifax and Experian. The first ban is 21 days and free.
The national identity and cyber support service for Australia and New Zealand. They help you build a plan. They are not your bank, and they are not the OAIC.
No. It is useful for known public dumps of an email address. It will not list every Australian corporate breach, and it will not protect you.
Usually no. Write to the organisation first and give them 30 days. Then a written complaint to the OAIC.
No. Data already taken is already taken. A hardened phone and tighter accounts reduce what is available next time.
ReportCyber and 1300 292 371, IDCARE, your bank, AFCA, the ATO for tax-identity issues, the OAIC for a privacy complaint, and eSafety for online abuse.
Your personal data and documents should be treated as gold.
Do not click the link.
Confirm the notice on the organisation’s own website. Change the password and turn on two-factor authentication. Call the bank and IDCARE if money or identity documents were involved. Place a credit ban. Treat every follow-up message as a scam until the official site says otherwise.
-> Discover free Privacy Tools
-> See Privacy Phones
-> See Privacy Laptops
[Last updated: 30 October 2026. Educational only – not legal advice]
