Services Australia Third-Party Data Breach Notification Powers

**Services Australia Seeks New Powers to Compel Third-Party Breach Disclosures Amid Rising Cyber Threats** Services Australia, which manages data for 27.5 million Australians, is pushing for expanded authority to require third parties to disclose breaches involving government identifiers, such as Medicare and Centrelink numbers. The move follows a dramatic surge in notifiable data breaches—from seven in 2022–23 to 82 in 2024–25—primarily driven by phishing attacks where individuals unknowingly shared credentials with impersonators. While the agency established response plans after the 2022 Optus and Medibank breaches, it currently lacks legal power to compel third parties to report incidents involving its identifiers. A federal audit recommended legislative reforms to mandate timely notifications, with support from the Attorney-General’s Department and the Office of the Australian Information Commissioner (OAIC). The audit also revealed systemic delays in breach reporting: 71% of the 165 notifiable data breaches (NDBs) reported to the OAIC between 2018–19 and 2024–25 were disclosed 50 or more days after detection. Internal reviews dating back to 2023 found Services Australia frequently missed the 30-day statutory assessment deadline, though the agency claims to have addressed these gaps by October 2023. In June 2025, Services Australia introduced a new "data breach mailout service" to directly notify affected individuals via mail or digital channels, though its effectiveness remains under evaluation. The proposed reforms aim to close gaps in breach transparency, particularly where third-party custodians hold sensitive government-linked data.