The weak link in Australia's breach wave is someone else's software

Mathspace, Quest Apartment Hotels and a string of car dealers and clinics have all been hit in recent weeks. The common thread runs through the vendors and tools those companies rely on.

Australia's data breach list keeps growing. In the past two months alone, Mathspace has disclosed that details of more than a million students, parents and teachers were taken, Quest Apartment Hotels has confirmed a breach involving more than 1.5 million records, and ransomware attacks have hit businesses ranging from furniture retailer Nick Scali to car dealerships and medical clinics, according to Webber Insurance's running list of Australian breaches.

The official numbers were already heading the wrong way. The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in 2025, up 8 per cent on 2024 and the most since mandatory reporting began in 2018. Malicious or criminal attacks caused 716 of them. Health services reported the most breaches, followed by financial services and the Australian Government.

"The threat posed to Australian businesses and organisations by data breaches is substantial," Privacy Commissioner Carly Kind said.

Whether 2026 will beat that record is not yet known. The OAIC has not published figures for this year. What is clear is how many of the biggest recent breaches came through a supplier rather than a company's own systems.

Mathspace was breached through a flaw in Metabase, a third-party reporting tool it ran on its own servers. The same flaw was used against other companies around the same time. Quest said attackers got in through a vulnerability in a third-party service provider's system. Car dealer Sharp Motor Group's breach was also traced to a third-party cyber incident.

"For businesses, the detail that matters most is that this breach reportedly originated through a vulnerability in a third-party service provider, not Quest's own front door," Kash Sharma, Asia-Pacific managing director at security firm BlueVoyant, told Insurance Business.

The problem is structural. A mid-sized business might rely on dozens of software providers for payroll, bookings, reporting and customer records. Each one holds data and each one is a potential way in. Many companies assume that handing data to a vendor also hands over the risk.

"A lot of people think they're outsourcing that, like someone else has the data and so we don't have to worry about it," said Garrett Droege of broker WTW.

Under Australian privacy law, that assumption does not hold. An organisation that holds personal information remains responsible for protecting it, including when it uses outside providers.

There is a caution on the numbers. Rising notifications partly reflect better reporting, as more organisations understand their obligations under the notifiable data breaches scheme. A higher count is not the same as more attacks.

Breaches in 2026 look less like elaborate hacks and more like supply-chain failures: a vendor's flaw, a missed patch, an old system nobody was watching. We expect the OAIC's 2026 figures to show another rise, and regulators to start asking harder questions about how companies vet and monitor their suppliers. For businesses, the practical step is to list every provider that holds customer data and ask what each would do in a breach. For individuals, assume your details are already out there somewhere, and treat any unexpected message asking you to confirm personal information with suspicion.