In today’s digital world, data privacy has become more than just a regulatory obligation—it’s critical to maintaining trust and security. The Notifiable Data Breaches Report (Report) from the Office of the Australian Information Commissioner (OAIC) paints a stark picture: the highest number of data breaches in the last 3.5 years was recorded in the first half of 2024.
This surge highlights the pressing need for organizations to fortify their data protection strategies. Failing to do so can result in fines of up to AUD 50 million or more for serious or repeated violations of the Australian Privacy Act 1988.
The Rise in Data Breaches & its Consequences
Between January and June 2024, a total of 527 data breaches were reported to the OAIC. This rise continues the upward trend observed in recent years, reflecting both the evolving sophistication of cyberattacks and the increasing regulatory emphasis on breach notification.
Leading Causes of Data Breaches
1. Malicious or Criminal Attacks
Malicious or criminal attacks remain the leading source of data breaches, responsible for 67% of incidents. These attacks range from phishing and ransomware to compromised credentials and malware. Within the category of cybersecurity incidents that lead to data breaches, 31% were due to phishing and 24% were due to ransomware. The impact of ransomware and phishing extends beyond financial loss, as it can lead to significant disruptions to business operations, reputational damage, and the loss of sensitive data.
2. The Role of Human Error
Alarmingly, human error accounted for 30% of the reported data breaches in this period. Errors such as sending personal information to the wrong recipient and failure to use BCC (blind carbon copy) in emails are prominent examples. This persistent challenge suggests that while technology and infrastructure play a crucial role in preventing breaches, human factors remain a weak link.
Key Recommendations for Businesses
The report highlights the need for businesses to strengthen their data protection strategies:
1. Stronger Data Security & Cybersecurity Measures
Under the Australian Privacy Act 1988, organizations must implement security measures to protect personal information and their systems from misuse, loss, unauthorized access, and disclosure. In the event of a data breach likely to cause serious harm, organizations are required to notify both regulatory authorities and affected individuals.
Recommendations
- To guard against malicious attacks, implement layered security controls and advanced measures, such as zero-trust models, strong encryption, and multi-factor authentication.Â
- Implement an effective post-incident data breach response plan.
How Securiti Can Help
2. Human Error Training
Under the Australian Privacy Act 1988, organizations are required to take reasonable steps to protect personal information. This includes minimizing human errors, such as unauthorized access or disclosure of sensitive data,
Recommendations
- Implement internal protocols and provide regular staff training on data handling.Â
How Securiti Can Help
- Securiti’s Risk Assessment solution helps organizations evaluate their internal protocols, ensuring the necessary technical and organizational measures are in place to prevent human errors.Â
3. Managing Third-Party and Supplier Chain Risks
Under the Australian Privacy Act 1988, organizations should establish a robust third-party or vendor risk management framework. While third parties based in Australia may be directly liable, organizations are still responsible for mitigating risks posed when data is transferred to foreign entities.
Recommendations
- Select suppliers with proven security controls, define personal information handling responsibilities in contracts, and establish accountability clauses.Â
- Conduct vendor risk assessments and notifications of subcontractor engagement.
How Securiti Can Help
- Securiti’s Vendor Risk Management solution automates vendor risk assessments, tracks subcontractor engagements, and data breaches, and provides automated alerts, supplier assessments, and security audits for ongoing third-party risk monitoring.
Automate Breach Management & Notification with Securiti
Fortunately, Securiti’s suite of automation modules offers a comprehensive solution for organizations seeking to ensure compliance with data breach and notification provisions as outlined under several evolving data privacy laws.
Securiti is the pioneer of the Data Command Center, a centralized platform that enables the safe use of data and GenAI. Securiti provides unified data intelligence, controls, and orchestration across hybrid multi-cloud environments. Large global enterprises rely on Securiti's Data Command Center for data security, privacy, governance, and compliance.
Securiti’s Breach Management automation provides incident response workflows that help organizations respond to privacy incidents promptly and effectively. This enables organizations to take reasonable steps to protect personal information from unauthorized access, disclosure, alteration, misuse, or deletion before processing it.
Request a demo to learn more.
