Patient details exposed in cyberattack on Australian healthcare provider

An Australian healthcare provider has been hit by a cyberattack that has stolen personal information from 21 clinics in its national network, including test results, consultation notes and Medicare details.

Partnered Health on Wednesday notified patients of the cyberattack more than three weeks after becoming aware that a “malicious actor” accessed its data.

Clinics in Ultimo, Castle Hill, Sans Souci and Dural are among the Sydney general practices where personal medical information has been stolen, including diagnostic and pathology results recorded at the clinics, and consultation notes and referral letters held by the practices. Personal information such as home addresses, private health insurance details and Medicare information has also been compromised.

Partnered Health clinics in Victoria, Queensland, Western Australia and the ACT also had data breached. The extent of damage caused by the cyberattack is yet to be gauged at five clinics – three in WA and two in Victoria – as Partnered Health continues to investigate what data may have been extracted.

“While there is no direct evidence that patient records have been viewed, as a precaution we have written to patients from these clinics to make them aware of this and provide details of steps that can be taken to protect their information,” a Partnered Health spokesperson wrote in a message to customers on Wednesday.

“We understand that this sort of news can cause concern. We sincerely apologise for any distress this may have caused our patients.”

Partnered Health, established in 2013, has 60 clinics across Australia. It describes itself as bringing together “many of Australia’s most trusted names in healthcare”, with a “reputation for excellence” as one of the country’s “leading healthcare providers”.

The cyberattack has been reported to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and law enforcement to investigate the origins and circumstances of the breach.

Partnered Health has obtained an interim injunction order in the NSW Supreme Court to prevent the accessed data from being used or published. It’s unclear how many patients have been affected by the data breach and what particular data may have been stolen.

A Home Affairs spokesperson told this masthead the federal government was aware of the cyberattack, and that its “relevant agencies are engaged”. Partnered Health have been contacted for comment.

Be the first to know when major news happens. Sign up for breaking news alerts on email or turn on notifications in the app.