Two-Thirds of Australians Expose Private Data to Cybercriminals

Two-thirds of Australians are leaving personal information exposed online in ways that cybercriminals can easily exploit, according to new research from the Australian government’s Home Affairs department. The findings, released in April 2026, reveal widespread gaps in digital hygiene among the population, with significant implications for individuals, businesses, and national cybersecurity resilience.

The study, conducted by Home Affairs’ Cyber and Infrastructure Security Centre, surveyed over 5,000 Australian adults about their online behaviours. It found that 66% of respondents routinely share or store sensitive personal data — such as full names, dates of birth, addresses, phone numbers, and even tax file numbers — on platforms or in formats that are publicly accessible or inadequately protected. This includes information posted on social media profiles, saved in unsecured cloud storage, or shared via messaging apps without encryption.

Among the most common risks identified were the public display of birthdates and hometowns on social networking sites, which cybercriminals use to bypass knowledge-based authentication systems. Over 40% of participants had their full birth date visible on at least one social media profile, while nearly a third listed their hometown or high school — details frequently used in security questions for banking, email, and government accounts.

28% of respondents admitted to storing scans or photos of identification documents — such as driver’s licences or passports — in personal email accounts or cloud drives without password protection or encryption. The report notes that such files are frequently targeted in credential-stuffing and phishing campaigns, often serving as a gateway to identity theft.

The research also highlighted a significant generational divide. Australians aged 18 to 34 were the most likely to overshare personal information, with 72% exhibiting at least one high-risk behaviour, compared to 58% of those aged 55 and over. However, older Australians were more likely to fall victim to scams once their data was compromised, suggesting differing risk profiles across age groups.

Home Affairs officials warned that the aggregation of seemingly innocuous data points enables cybercriminals to construct detailed profiles used in targeted attacks. “We’re seeing a rise in sophisticated social engineering that doesn’t rely on hacking technical systems, but on exploiting the information people freely give away,” said a spokesperson for the department. “When your birthday, pet’s name, and favourite sports team are all public, guessing your password or answering your security questions becomes trivial.”

The findings have prompted renewed calls from cybersecurity experts for stronger public education campaigns and clearer guidance from businesses on data protection. Industry groups such as the Australian Information Industry Association (AIIA) have urged companies to move beyond basic password policies and implement multi-factor authentication as a standard, particularly for customer-facing services.

Financial institutions, in particular, face growing pressure to enhance safeguards. According to the Australian Banking Association, identity theft and account takeover fraud cost the sector over AUD 500 million in 2025, with a significant portion traced to socially engineered attacks using publicly available personal data. Banks are increasingly investing in behavioural biometrics and AI-driven anomaly detection to counter threats that exploit human behaviour rather than technical vulnerabilities.

The Home Affairs report recommends a national awareness initiative modelled on past successful campaigns, such as those for sun safety or drink driving, to improve cyber hygiene. It also calls for clearer labeling of privacy settings on major platforms and greater transparency from tech companies about how user data is shared and retained.

As Australia continues to digitise public services and expand its digital economy, the research underscores that technical defences alone are insufficient. Protecting citizens from cybercrime requires addressing the human element — the everyday choices that leave personal information exposed in plain sight.