They can't lose what they don't hold: what this month's data breaches mean for your documents

PrivacyPublished 28 October 20266 min read

On 26 October, the Office of the Australian Information Commissioner (OAIC) released its latest data breach figures. Between January and June 2026, organisations reported 667 breaches. The number affecting more than a million people each rose from 4 in the previous six months to 11, and health service providers reported the most breaches of any sector, 149.

The Commissioner, Carly Kind, summed up the lesson in one line:

"Organisations can't lose personal information they don't hold."

She was speaking to businesses. But the same idea works just as well for the rest of us, especially in a week when many Australians are emailing payslips, receipts and bank statements to an accountant ahead of the 31 October deadline for people lodging their own tax return.

A month of reminders

October has made the point several times over:

An accounting firm. Poole Group, a Sunshine Coast accounting and business advisory firm, was listed on the leak site of the LockBit ransomware group. The firm has told the OAIC, the Australian Cyber Security Centre and the ATO, and is working with external specialists to find out what was affected. Accountants hold some of the most sensitive paperwork people have.
A cancer care provider's supplier. Icon Cancer Centre confirmed unauthorised access to some patient information held on a supplier's system, not its own. A hacker selling the material claims to hold more than 31,000 documents, a figure that has not been verified. Icon believes the records are correspondence documents rather than complete patient files.
Across the Tasman. A ransomware attack on ZenTech, a Dunedin company that provides laboratory services to the pharmaceutical industry, captured information from some Otago and Southland coronial cases. New Zealand's Ministry of Justice says it has no contract with ZenTech and is still investigating how the firm came to hold the information.
And attacks are getting faster. On 22 October the ABC reported two critical flaws in PHP, which an estimated seven in ten websites run on. AI models helped a security firm confirm one of them, and the maker of those models warned that the same ability could help attackers build exploits quickly. Security expert Troy Hunt told Australians to expect more data breaches.

The pattern is hard to miss. Your documents don't stay with the business you gave them to. They pass to software providers, suppliers and contractors you've never heard of, and every one of those copies is another chance for a breach.

You can't fix their security, but you can share less

Most people can't audit an accountant's IT or a doctor's suppliers. What they can control is how much they hand over, and to how many places. Here is how to apply the Commissioner's advice to your own paperwork.

Send only what's needed. If your accountant needs your annual payment summary, send that, not your whole year of payslips. If a real estate agent wants proof of income, one page is usually enough. Before attaching a file, ask what the other person actually needs, then split out just those pages or pick and reorder them.
Redact what they don't need. A bank statement as proof of address needs your name and address, not six months of transactions. Redact what isn't needed with a proper redaction tool. Drawing a black box over text often leaves the words underneath, where anyone can copy them back out.
Strip the hidden details. PDFs and photos carry metadata: author names, edit dates, device details, and sometimes GPS locations in photos. Sanitise a PDF, edit its metadata or remove the metadata from a photo before sharing it.
Lock down what you do send. For tax documents, medical records and identity documents, add a password. Use a long passphrase (the Password Generator can make one) and send it separately, by text or phone, never in the same email.
Don't add another company to the chain. This is the step most people miss. Uploading a document to a free online PDF converter to merge, compress or sign it adds one more company, and one more server, holding a copy of the file. That company has its own suppliers, its own backups and its own breach risk. If the job can be done without uploading the file, do it that way.
Ask for old documents to be deleted. Businesses covered by the Privacy Act generally have to destroy or de-identify personal information once they no longer need it, unless the law requires them to keep it. If you've finished with a real estate agent, a lender or a recruiter, it's reasonable to ask them to delete the documents you sent.

Tax deadline checklist

31 October is the deadline for most people who lodge their own return. People using a registered tax agent usually have later dates, so check with yours. Sending documents to an accountant this week? A quick routine:

Send only the documents they've asked for.
Combine them into one file so nothing goes astray.
Password-protect it, and text or phone the password through.
Use your accountant's secure client portal if they have one.
Delete the copies from your "Sent" folder and downloads once you've lodged.

If your details are caught up in a breach

Change your passwords for affected accounts, and anywhere you've reused them, and turn on multi-factor authentication.
Be extra wary of calls, texts and emails that mention the breach. Scammers use the news to sound legitimate.
In Australia and New Zealand, IDCARE offers free support if your identity information has been exposed.

Where Fair Go PDF fits

Fair Go PDF is built on exactly the principle the Commissioner described: it can't lose your files, because it never has them. Every tool runs in your browser, so documents are processed on your own device and never uploaded to a server. Each step above has a matching tool, and all of them are free with no account. The source code is open source, so anyone can check how it works. How to tell a tool that uploads from one that doesn't is covered in is it safe to use free online PDF tools?

Sort a document without handing it over

Browse the tools

Frequently asked questions

What did the OAIC's latest data breach report show?

The OAIC received 667 data breach notifications between January and June 2026. Breaches affecting more than one million people rose from 4 to 11 compared with the previous six months, and health service providers reported the most breaches of any sector.

Is it safe to email tax documents to my accountant?

Email is common but not ideal. Send only what's needed, password-protect the file and send the password separately. Use your accountant's secure portal if one is available.

Do free online PDF tools keep a copy of my files?

Many upload your file to their servers to process it, so a copy exists outside your control, at least for a while. Browser-based tools like Fair Go PDF process files on your device instead.

What should I do if my information is in a data breach?

Change affected passwords, turn on multi-factor authentication, watch for scams that mention the breach, and contact IDCARE for free support in Australia or New Zealand.