Data and statistics

Data breach statistics by sector

Last checked 24 October 2026 · 6 sources

Short answer

Health and finance top the sector tables published in Australia and Canada. Australia's OAIC received 1,205 breach notifications in 2025, and health service providers sent the most, 225 ¹. In Canada, businesses reported 696 breaches in 2025-26, and the financial sector reported 172 of them ². Ireland's DPC split 2025 GDPR notifications into 49% private sector and 45% public sector ³. Causes differ too. Malicious or criminal attacks led in Australia, and misdirected correspondence led in Ireland ^1,3.

Australia, notifications in 2025: 1,205 ¹
Australia, top sector in 2025: Health service providers, 225 ¹
Canada, business breach reports 2025-26: 696, affecting 20,328,495 Canadians ²
Canada, top sector 2025-26: Financial, 172 ²
Ireland, valid notifications 2025: 6,521 ³
France, notifications 2025: 6,167, with hacking at 50% ⁴

Australia, calendar year 2025

The OAIC published 2025 figures under the Notifiable Data Breaches scheme on 6 July 2026. Notifications rose 8% to 1,205. Malicious or criminal activity caused 716 ¹.

Sector, 2025	Notifications
Health service providers ¹	225 ¹
Financial services ¹	157 ¹
Australian Government ¹	118 ¹
Business and professional associations ¹	103 ¹
Education ¹	81 ¹
Legal, accounting and management services ¹	81 ¹

Canada, 2025-26 reporting year

Canada's Privacy Commissioner received 696 breach reports from businesses under PIPEDA in 2025-26. Unauthorised access caused 78% of them, and 68% of those came from a cybersecurity incident ².

Federal institutions reported 451 breaches under the Privacy Act. Mishandling of information caused 368. Cyber incidents caused 39 ². Total breach reports fell to 1,147 from 1,301 in 2024-25 ².

Business sector, 2025-26	Breach reports
Financial ²	172 ²
Telecommunications ²	91 ²
Insurance ²	62 ²
Services ²	53 ²
Sales and retail ²	52 ²

Ireland, calendar year 2025

The DPC received 6,521 valid breach notifications in 2025. Of these, 5,692 were under the GDPR. The private sector made 49% of GDPR notifications, the public sector 45% and voluntary or charity bodies 4% ³.

About half of notified cases involved correspondence sent to the wrong recipient ³. Notifications under the ePrivacy regulations, S.I. 336/2011, are counted separately. There were 731 of them. Misdirected communications made up 35%, social engineering or phishing 34% and human error in recording details 22% ³.

France, Spain and Luxembourg, 2025

France: the CNIL received 6,167 breach notifications in 2025, up 9.5%. Hacking accounted for 50% ⁴.
Spain: the AEPD release gives two counts for data breach procedures. It says they rose from 30 in 2024 to 77 in 2025 and led to fines of €19,836,603, about 40% of its total fines. Its list of most active areas shows 46 finalised sanctioning and warning procedures on data breaches ⁵.
Luxembourg: the CNPD processed 425 breach notifications in 2025 ⁶.

Reading these figures

The periods differ. Australia, Ireland, France, Spain and Luxembourg report calendar year 2025 ^1,3^4,5⁶. Canada reports its 2025-26 year ². Each regulator uses its own sector list and its own test for when a breach must be notified, so a sector's count in one country cannot be added to or ranked against another country's count. Counts measure notifications made, not all breaches that happened.

Common questions

Which sector has the most data breaches in Australia?

Health service providers notified 225 of 1,205 breaches in 2025, followed by financial services with 157 ¹.

What causes most breaches in Canada?

Unauthorised access caused 78% of business breach reports in 2025-26. For federal institutions, mishandling of information caused 368 of 451 reports ².

What is the most common breach in Ireland?

Correspondence sent to the wrong recipient. About half of notified cases in 2025 involved it ³.

Can I compare sector counts across countries?

Only with care. The periods, sector lists and notification thresholds differ between regulators ^1,2³.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.

Sources

What counts as a personal data breach
How the GDPR, the UK ICO, US HIPAA, Canada, Australia and Brazil define a personal data breach, with official examples and reporting tests.
The HHS OCR breach portal explained
What the US HHS Office for Civil Rights breach portal lists, how HIPAA breaches are reported, and what the 2024 report to Congress shows.
Breach notification rules compared
Breach notice deadlines and triggers in the EU, UK, US, Canada, Australia, Singapore, India and Brazil, from laws and regulator pages.
Data protection regulators in Asia-Pacific
Breach figures, penalties and powers of privacy regulators in Australia, New Zealand, India, South Korea and Japan, from official releases.
EU data protection authorities compared
Complaints, fines, breach notices, staff growth and handling times at EU data protection authorities, from the Commission and national annual reports.