What to Do If Your Details Are Caught Up in a Data Breach

Getting an email saying a company has lost your data is unsettling. Knowing what it means, and what to do next, makes it manageable.

Data breaches have become common news in Australia, and millions of people have had personal details exposed. A breach doesn’t automatically mean harm, but it does mean it’s time to take a few protective steps.

How the Notifiable Data Breaches scheme works

Under the Notifiable Data Breaches (NDB) scheme, organisations and agencies covered by the Privacy Act 1988 must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. The OAIC explains that:

• A data breach happens when personal information is lost or accessed or disclosed without authorisation.
• “Likely” means more probable than not, not just possible.
• Serious harm can include identity theft, financial loss through fraud, threats to physical safety and serious psychological or reputational harm.
• Organisations generally have 30 days to assess a suspected breach, though the OAIC expects them to move quickly.
• If contacting people directly isn’t practicable, they may publish a statement on their website instead.

Step 1: Work out what was exposed

Read the notice carefully. Was it your email address, password, card details, identity documents, or a mix? What you need to do depends on what was taken.

Step 2: Secure your accounts

• Change the password for the affected account, and anywhere else you used the same one.
• Turn on multi-factor authentication where available; see our guide to MFA.
• Use a different passphrase for every account from now on. A password manager makes that practical.

Step 3: Protect your money

• Cancel cards if card details were exposed, and ask your bank about monitoring.
• Check bank statements regularly for transactions you don’t recognise.
• Check your credit report for applications you didn’t make. You can request free credit reports from Australia’s credit reporting bodies.

Step 4: Protect your identity

If identity documents such as your driver’s licence, passport or Medicare card were exposed:

• Contact IDCARE on 1800 595 160 for free, tailored advice.
• Contact the agency that issued the document about replacing it or adding protections.

Step 5: Stay alert

Exposed contact details can be used for targeted scams for months or years. Our guide to spotting and reporting scams covers the warning signs and who to contact.

If you’re not happy with how it was handled

You can complain to the organisation first. If you’re not satisfied with its response, you can lodge a complaint with the OAIC.

Your questions answered

How do I know if a breach notice is genuine?

Scammers sometimes send fake breach notices. Don’t click links in the message; go to the company’s official website or contact it directly to confirm.

If I didn’t get a notice, am I safe?

Not necessarily. Organisations may only notify people at risk of serious harm, or may publish a statement instead of contacting everyone. If you’re a customer of a breached company, it’s worth taking the basic precautions anyway.

Should I replace my driver’s licence or passport?

If your identity document details were exposed, contact the issuing agency for advice, and contact IDCARE for a response plan. Rules and options vary by document and state.

Can I complain about how a company handled my data?

Yes. Complain to the organisation first. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC).

This guide is general information, not technical or legal advice. If you’ve lost money or personal information, contact your bank, IDCARE on 1800 595 160, or report it through ReportCyber at cyber.gov.au.