Australians have been warned about the lingering threat they face in the wake of recent cyberhacks.

The country’s largest energy retailer Origin, health service network Partnered Health Group, popular telehealth provider Updoc and apartment hotel chain Quest are among the high-profile targets of online criminals since June.

Names, addresses, banking details, birthdays, contact information, Medicare numbers and private health insurance are among the trove of data confirmed or feared to have been leaked during the disturbing digital attacks.

Know the news with the 7NEWS app: Download today

But a data breach “doesn’t need to hand criminals a complete identity in one file”, AI cybersecurity platform SentinelOne Australia and New Zealand division vice-president Jason Duerden said.

“A name and phone number from one incident can be matched with an address, date of birth or account detail from an earlier breach, then enriched with information from social media, LinkedIn and other public sources,” Duerden told 7NEWS.com.au.

“AI is making that assembly process much faster.

“Cybercriminals can sort huge datasets, identify which records belong to the same person and generate a tailored approach around what they know.”

Digidentity managing director Fred Slikker said the danger is not just confined to the weeks after a breach.

“Stolen information can be retained, traded and combined with data from future incidents,” Slikker said.

“Australians affected by a breach therefore face a continuing risk of impersonation and identity misuse, even after they have changed their password or replaced a compromised card.”

What scams might look like

Once cybercriminals believe they have pieced together enough information, they strike.

“An affected customer might receive a call that correctly references their energy provider and address, before being transferred to a fake ‘bank security team’ that already knows partial financial details,” Duerden said.

“Every fact may be real, while the person joining those facts together is a criminal.

“The danger isn’t any single piece of exposed information. It’s the credibility created when several accurate details appear in the same conversation.”

Australians have been warned about the lingering threat they face in the wake of recent cyberhacks. Credit: Dave Hunt/AAP

Hustles — including phishing, payment redirection, relationship, and impersonation scams — are lucrative.

More than 120,000 reports were made to ScamWatch and ReportCyber in the first six months of 2026, with Australian victims fleeced of more than $554 million.

Authorities say the figure, released by the National Anti-Scam Centre during Scams Awareness Week, likely understates the true cost of scams, with many going unreported.

“Behind every reported loss is a person who has been harmed, whose life has been disrupted by criminals using pressure, impersonation, psychology and technology including AI to steal their money or identity,” Australian Competition and Consumer Commission deputy chair Catriona Lowe said.

AI supercharges scam threat

Duerden said the “economics have changed in the scammer’s favour” because while a human criminal can research only so many people and manage only so many conversations, AI “can produce thousands of personalised approaches” and adjust tactics “around the clock without losing concentration”.

“That removes many familiar warning signs we’ve all become used to,” he said.

“The message can use natural Australian English, refer to the correct provider and maintain a fairly convincing conversation across email, text and chat.

“Worryingly, scammers can test several stories, learn which one gets a response and concentrate human effort on victims most likely to pay.

“People are being asked to make a perfect judgement under pressure, while criminals can keep trying until something works.

“One moment of trust may be enough for the attacker, (but) the consumer is expected to remain sceptical every time the phone rings.”

Three steps to stay safe from scams

All companies at the centre of recent breaches have warned customers and patients to remain on alert for suspicious emails, texts and phones calls.

Generally, ScamWatch’s three tips to protect against scams are:

• Stop before you share money or personal information.
• Check who you’re really dealing with using contact details you find yourself.
• Protect yourself and others by reporting scams to your bank, cyber.gov.au, and ScamWatch.

While those are tips are simple, experts admit it can be tough to keep your head under the pressure tactics and convincing stories used against victims.

“Public education still very much matters here, but ‘stop and check’ isn’t a sufficient national defence guideline when a scam has been built using a person’s stolen data, a trusted Australian’s cloned voice and a convincing copy of a legitimate website,” Slikker said.

AI OR REALITY? TAKE OUR TEST TO SEE IF YOU CAN TELL THE DIFFERENCE

Duerden said any unexpected contact referring to recent breaches — including messages offering compensation, account protection or help securing your identity — must be treated with caution.

“Criminals exploit the anxiety surrounding a public breach because customers are expecting to hear from the affected organisation,” Duerden said.

“Secure your email first because it can be used to reset other accounts, then replace any reused passwords and turn on multi-factor authentication for email, banking, myGov and other sensitive services.

“Stolen data can be traded, combined with later breaches and reused for years, so vigilance needs to continue long after the initial notification.”

Since July, businesses and services are required to register their branded text messages as part of a government crackdown on scam text messages.