The Most Common Cause of Mega Data Breaches in Australia

The frequency and severity of mega data breaches in Australia have surged in recent years, exposing the personal information of millions. According to StickmanCyber's 2025 report on data breaches in Australia, the number of breaches affecting one million people or more doubled in the five years to 2023. But what are the primary causes behind these catastrophic breaches? Analysing over 6,000 Notifiable Data Breach (NDB) reports submitted to the Office of the Australian Information Commissioner (OAIC) between February 2018 and October 2024, the report uncovers alarming insights into the leading causes of mega breaches.

Compromised Credentials: The Leading Culprit

One of the most striking findings in the report is that the vast majority of mega breaches in Australia result from compromised credentials. While malware and phishing attacks are often cited as common causes of cyber incidents, breaches affecting over one million individuals overwhelmingly stem from compromised login details.

In nearly half of all mega breaches, the method used to steal credentials remains “unknown.” This highlights a major security gap, as organisations often fail to determine the precise attack vector used to compromise sensitive data. It underscores the importance of robust authentication practices and credential management.

How Credentials Are Compromised

1. Password Reuse and Weak Credentials — Many users and employees reuse passwords across multiple platforms, making them an easy target when one platform is breached.
2. Credential Stuffing Attacks — Cybercriminals leverage stolen login details from previous breaches to access other accounts where users have reused passwords.
3. Phishing Attacks — While phishing did not directly contribute to the largest breaches, it remains a prevalent method for stealing credentials in smaller incidents.
4. Brute-Force Attacks — Automated bots attempt thousands of password combinations until they gain access to an account.
5. Dark Web Leaks — Stolen credentials are often traded on the dark web, allowing cybercriminals to access sensitive systems with minimal effort.

Other Common Causes of Mega Breaches

While compromised credentials are the leading cause, other cyber incidents also play a role in major data leaks:

• Hacking and Unauthorised Access — Attackers exploit system vulnerabilities to gain unauthorised access to sensitive databases.
• Insider Threats — Employees or contractors with privileged access intentionally or unintentionally expose sensitive data.
• Ransomware Attacks — Though not the dominant cause of mega breaches, ransomware remains a significant threat, encrypting and leaking vast amounts of data.
• Supply Chain Vulnerabilities — Third-party vendors with weak security practices provide an entry point for attackers.

The Importance of Early Detection

The report reveals that nearly a third (28%) of mega breaches took 30 days or more to identify, or the organisation could not provide an identification date. Delayed detection worsens the impact of a breach, giving attackers more time to exfiltrate and exploit sensitive information. Australian organisations, particularly in the public sector, struggle to identify breaches promptly, highlighting the urgent need for improved detection and response capabilities.

Mitigating the Risk of Mega Breaches

Given the prevalence of compromised credentials and other cyber threats, organisations must take proactive steps to protect sensitive data. Key strategies include:

• Enforcing Strong Authentication — Implementing multi-factor authentication (MFA) to add an extra layer of security beyond passwords.
• Regular Security Audits — Conducting routine audits to identify and address vulnerabilities before they can be exploited.
• Employee Cybersecurity Training — Educating staff about phishing, password hygiene, and secure data handling practices.
• Advanced Threat Detection — Deploying real-time monitoring tools to detect and respond to breaches swiftly.
• Zero Trust Security Model — Adopting a “never trust, always verify” approach to limit unauthorised access.

Conclusion