“Severely outmatched” government agencies are slower than private companies at detecting and reporting data breaches, an analysis of Office of the Australian Information Commissioner (OAIC) data has shown as AI agents ravage agencies amidst calls for change.
Security firm Adaca’s analysis of almost 4,800 incident notifications lodged under the notifiable data breaches program between 2022 and the first half of 2026, found the number of reported breaches had jumped by 69 per cent in four years.
Despite expectations that organisations report breaches in a timely manner, government bodies took an average of 108 days to notify the OAIC about their incidents – compared to just three days for companies in 11 other analysed industries.
It was a “quite surprising” finding, Adaca founder Lambros Photios told Information Age, because “we didn’t expect the public sector to be the most progressive or the best – but we did expect that they’d at least be on top of things.”
There were small signs of improvement this year, with reporting timeframes shortening in the first half when 38.4 per cent of breaches were reported within 10 days, compared to 31.6 per cent last year.
Similarly, the proportion of breaches that took over 30 days to be reported dropped to 18.6 per cent this year, down from 23.9 per cent last year and 27.4 per cent in 2024 – a trend that Photios attributes to broader use of AI-powered incident detection systems.
“What this has revealed is that not just as a sector, but also at a global level, we are massively at risk,” he said, adding that “there’s a certain irony where the public sector is quick to put rules in place for the private sector, but it isn’t willing to actually take on that regulation themselves.”
In a country that is racing to adopt AI faster than nearly any other, he said, “what is most concerning for me is that the public sector isn’t keeping up… they’re actually going to have to start applying the brakes because they can’t keep up.”
Australian government agencies reported 399 data breaches since 2022 and were by far the slowest to report them to regulators. Image: Adaca analysis of OAIC data
AI running circles around government defences
The figures – which Adaca obtained via a freedom of information request – come amidst revelations that OpenAI agents accessed public and non-public data inside at least five federal and state government websites, and dozens of other institutions globally.
Governments’ legacy IT systems are at least partly to blame, with security audits finding agencies “unprepared” and the Australian Information Security Association welcoming a recent Home Affairs mandate that agencies review and fix their exposure.
Nearly every organisation has seen AI tools or agents accessing sensitive data beyond their intended scope, according to a recent Delinea multi-country survey that also found just 12 per cent of Australian firms can detect such violations as they happen.
The “superhuman” speed of AI agents “makes it a lot easier to find vulnerabilities or exploit zero days,” Photios said, adding that “using AI tools, [attackers] can navigate through a company’s most valuable assets and steal them before the target knows they’ve been hit.”
“For a sector that typically only discovers a breach after 100 days, government is severely outmatched.”
Has the OAIC’s role run its course?
As OpenAI and Anthropic welcome clearer rules around notifying data breaches, Australia’s government has initiated a rapid review of reporting, information sharing, and other policies around cyber incidents involving AI.
While the OAIC has been the intermediary for notifiable data breach reporting since the scheme was created in 2018, some argue that extending this structure to AI data breaches is preventing victims from acting quickly to evaluate and contain their damage.
AI firms should be required to directly notify users or their legal representatives after a breach by AI agents, argues Rebecca Robertson, chief operating officer of legal technology firm Quillio, who warns that “government regulation can only go so far.”
“The conversation is about mandatory reporting to government, but the fallout lands at the firm using the tool, and on the client data inside it,” she said, adding that “government reporting can follow as a matter of procedure, but the goal is to minimise harm.”
Incidents should be reportable “even where no serious harm results,” the Law Society of South Australia (LSSA) argued in a recent submission to the Law Council of Australia that flagged laws in the European Union and California as providing valuable guidance.
Regulations should include a “materiality threshold and a clear timeframe for reporting,” LSSA argues – noting that “a notification scheme will only be effective if developers are compelled to report incidents of this kind promptly and through a designated channel.”
Whether that channel continues to involve the OAIC remains to be seen; as its remit expanded over the years, the chronically under-resourced agency has struggled to stay ahead of the explosion in demand.
Last November, the OAIC launched a statistics dashboard it said would “provide a more dynamic view” of reported incident data – yet the dashboard has not been updated since, with its latest data relating to the first half of 2025.
“Work is in progress” on an update, an OAIC spokesperson told Information Age, adding that “the OAIC is committed to making this information publicly available as soon as practicable to support transparency and aid in the understanding of data breach trends in Australia.”
