A malicious actor accessed Partnered Health's data on 23 June, compromising 21 clinics across Sydney, Melbourne, and Canberra. Stolen information includes treatment details, consultation notes, referral letters, pathology results, Medicare numbers, private health insurance details, names, dates of birth, and addresses.
Expert warns of dark web sales
Dr Suelette Dreyfus, senior lecturer at the University of Melbourne, warned that medical records could be sold on the dark web for up to US$250 per record, far exceeding the few cents for basic personal information. She noted that combining medical data with other datasets creates detailed profiles that pose substantial privacy risks.
Partnered Health obtained an interim injunction from the NSW Supreme Court to prevent use or publication of the data. However, Dreyfus stated the injunction is unlikely to stop sales on the hidden market.
Limited recourse for victims
Unlike financial breaches, victims cannot change their medical history. Dreyfus urged Australians to monitor accounts for unusual activity, update device security, and change passwords regularly. She also called for increased cybersecurity training and public awareness.
Partnered Health has contacted affected patients but declined to disclose the number impacted, stating it is not in patients' interests. The incident was reported to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and law enforcement.
Previous Australian data incidents
In 2022, Medibank refused a hacker group's demand, leading to the publication of 9.7 million customers' data on the dark web. In 2019, the Victorian auditor general used basic hacking tools to access sensitive patient data at three hospitals, prompting accepted recommendations.
