Scope & interpretation
An incident register, not a national incident census
This register combines selected public disclosures, unverified actor claims, supplied incident-register reports, Australian Data Breach Archive reports and image references. No public organization-level register covers every Australian cyber incident from 2000 to 2026. Records may be incomplete, and absence from this collection does not mean no incidents occurred. Dates use the event, publication or register date identified in each label. A public disclosure does not necessarily confirm actor attribution or additional claims from the supplied register. The supplied 2024 image entries are labeled Reference only because the images do not provide primary citations.
The actor-list import contained 541 AU/Australia-tagged source rows before deduplication. Claim summaries use available incident details without treating them as verified facts. Register reports retain the supplied incident type, severity, location, sector and notes; the export provides no independent verification or citation URLs. International entries remain labeled international. Source labels identify merged reports, and existing public citations are retained. Source links are references, not corroboration; onion links are omitted. Download original yearly actor-claim source counts (CSV).
Records for the same normalized organisation, calendar year and month are merged, including reviewed name aliases. Entries in different months or years remain separate, even when they may concern the same underlying event. Anonymous image references also require matching locations before merging. Counts therefore describe retained records, not unique incidents.
The archive import covers 394 incident documents. Their linked pages supply disclosure dates, sectors, summaries and source references; explicit dispute notes are retained. Archive reports remain attributed and are not treated as independently verified merely because the archive links to another source. Dates can differ from the underlying incident date, and unknown locations are not inferred from an organisation's name.
Charts count records in this page's dataset only. They are not OAIC Notifiable Data Breaches totals, a measure of all Australian cyberattacks, or a ranking of organizational risk. The 2026 selection is year-to-date through 22 October 2026.
Read OAIC Notifiable Data Breaches publications ↗