Over eight days in October, three Australian health providers either disclosed a breach or confirmed they were investigating a breach claim. A private hospital in Adelaide. A cancer-care group with more than forty centres across seven states and territories. A neurology practice with clinics in the Hunter and on the New South Wales Mid North Coast.
In two of the three, the organisation points at a supplier rather than at itself. One says so outright. The other says that is what it understands so far, with the claim still being verified.
That is the part worth stopping on. You can choose your bank. You can choose whether to shop somewhere. You did not choose the company that converts your oncologist's incoming faxes into email, and until this month you did not know it existed.
What can someone do with your medical records?
Three things, and they get worse in that order.
The first is ordinary identity fraud, because a medical file is an identity file. It carries your full name, your date of birth, your address, and in Australia it very often carries your Medicare number. That is the raw material for opening things in your name.
The second is the pretext. A scammer who knows which clinic you attend, who referred you, and what the appointment was for can write to you about your own care. Not a generic phishing email. A letter about the thing that is actually happening to you, naming the people who are actually treating you.
The third has no equivalent anywhere else, and it is why health data trades at a premium. A diagnosis is not a credential. It is a fact about your life, it is permanent, and you cannot issue a new one. A password that leaks is embarrassing for ninety seconds. A medical history that leaks is yours forever, and it was never a secret you chose to keep — it was a secret you were obliged to hand over to get treated.
We made this argument last week about names and email addresses, and health data is the extreme case of it. Almost nothing in a medical file has a reset button.
Three Australian health providers in eight days
Here is what each organisation has actually said, as distinct from what the people claiming to hold the data have said. The difference matters, and most coverage collapses it.
St Andrew's Hospital, Adelaide — 8 October
The private hospital reported a breach affecting, in its words, a group of individuals. It has not said how many people are involved or how it happened. Its chief information officer, Nathan Crettenden, said an internal investigation "identified that a subset of data from our servers was downloaded", and that the hospital is "taking all reasonable steps to limit the impact" of the incident. Systems were taken offline as a precaution, the environment was secured, and forensic specialists were engaged. The hospital says affected individuals have been notified, along with the Office of the Australian Information Commissioner and the Australian Cyber Security Centre. Chief executive Angela McCabe said affected individuals were given information and support on protecting their personal information. The South Australian Premier, Peter Malinauskas, said the state government expected to be briefed that day, and raised whether things had occurred "of a criminal nature" that might be subject of the South Australian criminal code.
Icon Oncology Group — 12 October
Icon published a notification on its own website on 12 October saying it was managing a data breach incident "involving unauthorised access to some patient information held on a supplier's system". The system was an externally hosted and managed platform that converts incoming faxes to email. Icon says that platform is not its main system for sending or receiving patient information, that the incident was contained immediately, and that its core clinical and patient management systems were not affected. It says it has obtained a copy of the impacted records and is working out which patients and what information are involved, and that "at this stage, we believe the records do not comprise complete patient files, but rather discrete documents associated with correspondence for our business." It believes the incident affects Australia only, though it has not confirmed that. It activated its incident response plan, reset access to the affected system, engaged specialist cyber security and forensic advisers, and notified the Australian Federal Police and relevant regulators. It says patient care and treatment are not affected and that it will contact affected patients directly.
Separately, and this is a claim rather than a confirmed finding, Cyber Daily reported on 12 October that a user on an underground forum was offering more than 31,000 documents said to come from Icon, describing them as sensitive and confidential, and listing patient names, addresses, diagnoses and Medicare details among the contents. The post went up around two days before Icon's notification. Icon has not published a figure for how many people are affected and has not listed the categories of data involved, so the 31,000 and the data types are the seller's account, not the provider's.
Hunter Neurology — 15 October
A ransomware group that surfaced in late September claimed to hold records from the practice, which operates at East Maitland, Shortland and Port Macquarie in New South Wales. The group's own itemised list, which it has not evidenced, is 15,252 patient images and scans, 11,819 patient letters and reports, 439 laboratory results and 839 patient records system files, along with four complete weekly backups of the practice's medical records system. It described the contents as protected health information including patient names, dates of birth and clinical data, and said it would publish within two days because it had not been paid.
The practice confirmed it is investigating. A spokesman said "we are aware that an unauthorised external party has made a claim online in relation to our practice", and — the sentence this whole article is about — "based on our investigations to date, we understand this claim relates to an incident affecting the environment of a third-party technology provider that hosts and supports our systems". It said it had engaged specialist cyber security and forensic experts "who are working urgently to verify these claims and to understand the nature and extent of any information that may have been affected". Patient services have not been interrupted, the Australian Cyber Security Centre has been notified, and the practice says that if personal information turns out to be affected it will contact people directly, provide practical steps, and notify the Information Commissioner. It added: "we sincerely apologise for any concern this news may cause."
The breach was at a company you have never heard of
Put the two supplier sentences side by side. Icon: unauthorised access to patient information held on a supplier's system, specifically a hosted fax-to-email platform. Hunter Neurology: an incident affecting the environment of a third-party technology provider that hosts and supports our systems.
Neither of those is unusual and neither is negligence on its face. Every clinic in the country runs on bought software. The practice management system, the imaging archive, the pathology interface, the appointment reminders, the transcription service and yes, still, in 2026, the fax gateway, because Australian healthcare continues to move referrals and results by fax and somebody has to turn those faxes into something a computer can read.
What follows from it is uncomfortable. The list of organisations holding your medical history is not the list of organisations you have dealt with. It is that list, plus every supplier each of them uses, plus every supplier those suppliers use. You cannot enumerate it. Your clinic may struggle to enumerate it. And consent, in any meaningful sense, stopped at the front desk.
This is not a new observation, it is just one that rarely reaches the people it happens to. When the Information Commissioner reported on the second half of 2023, secondary notifications — the ones that arrive because somebody else's breach reached your data too — had jumped to 121 from 29 in the previous six months, and the office noted that multi-party breaches most often follow a breach of a cloud or software provider. The then Commissioner, Angelene Falk, said organisations "need to proactively address privacy risks in contractual agreements with third-party service providers". That was February 2024. The two supplier cases above are what the unaddressed version looks like from the patient's chair.
What to do if your medical records were in a data breach
Here is the part that is usually missing, and it is missing for a specific reason. The standard breach checklist is built around credentials and cards, and a medical file contains neither. So the advice arrives as change your password and watch your bank statements, which addresses almost nothing that was actually taken.
There are four moves worth making. The first one surprises nearly everybody.
1. Get a new Medicare card number. You are allowed to.
Most people believe a Medicare number is permanent, like a name. It is not, and Services Australia says so in plain terms:
If your Medicare card number has been exposed in a data breach, you can get a replacement Medicare card.
Services Australia, How you can protect your personal information after a data breach
Two separate things sit behind that sentence, and conflating them is the easiest mistake to make here. A replacement card carries a new issue number and expiry date, so the old card stops working — but the card number itself does not change. Getting a different number is a second step: Services Australia says that if you want a new Medicare card number, you can transfer to a new card. Ask for both. You can request a replacement through myGov, through the Express Plus Medicare app, or by phone.
Allow for the wait. Services Australia says a new card arrives in three to four weeks, and the digital copy in the Express Plus Medicare or myGov app works straight away.
This is the single most useful thing in this article. A Medicare number sits in the identity-verification stack almost everywhere in Australia, it appears in medical correspondence constantly, and it is the one thing that was actually in the file that has a genuine reset behind it. The other two remedies below are controls you harden afterwards rather than data you take back. Nobody is going to offer any of them to you. Go and ask.
Worth knowing alongside it: Services Australia says a concession card exposed in a breach does not need replacing and can keep being used, and that if you are worried about an exposed Centrelink reference number, you can call your payment line to request additional authentication.
2. Put a secret password on your Services Australia records
Costs nothing, and barely known. You can add a secret password to your Medicare, Centrelink and Child Support records, by phone or in person at a service centre, so that somebody who has your details on paper still cannot talk their way into your file. You can go further and ask for your online accounts, phone self service and the Express Plus apps to be locked, which also has to be done by phone or in person.
That second option is worth considering precisely in the window after a breach you have been notified about, when the people holding your details are most likely to try. Services Australia runs a Scams and Identity Theft Helpdesk for exactly this, weekdays during business hours, and it can review your records for suspicious activity and add protections.
3. Expect something that looks like the clinic
A health breach is followed by people impersonating the health provider. Scamwatch has warned about this after a large Australian incident: its alert on messages impersonating Qantas, published 9 February 2026, notes that people who know or suspect they have been involved in a data breach may be at greater risk of being targeted, and that the messages work by creating a sense of urgency so you act without checking first. That alert is about an airline rather than a clinic, and the sentence that transfers is the generic one — the extension to health providers is ours.
Translated to this month: a letter, a text or a call about your appointment, your results, your account or your refund, arriving in the weeks after a breach, from something that appears to be your provider, is exactly what the data was stolen to make possible. Scamwatch's own instruction is the one to keep:
Never click a link, download an attachment, or enter personal or sensitive login information via a link in an email or message.
Scamwatch, scam alert, 9 February 2026
And then check by a route you found yourself. Scamwatch's wording for the Qantas case was to use the official app, the website, or a number you source yourself, and the principle transfers to a clinic without modification. Ring the number on the appointment card in your drawer, not the number in the message.
This is the same rule as the piece about an email that passed every authentication check, and it holds here for the same reason: you cannot verify a message from inside the message.
4. Ask the provider the one question that matters
When your provider contacts you, there is one question worth asking, and it is not whether your data was involved. They will tell you that anyway.
Ask: was my Medicare number in it?
That single answer determines whether step one applies to you. Everything else in a medical file is information you cannot withdraw, and knowing the detail will not change what you can do. The Medicare number is the one actionable item, so it is the one to establish.
If identity documents are involved — a licence, a passport, a Medicare card — that is also the point at which the heavier controls become appropriate. We went through those in the piece on switching off your driver's licence, and the reasoning for proportionality there applies here too: reaching for the heaviest tool every time is how people end up ignoring all of them.
Why a diagnosis is worse than a password
The clearest way to see what a health breach actually costs is to sort the contents by whether anything can be done about them.
What can and cannot be reset after a medical data breach, with the mechanism where one exists. The first row was in the file; the next two are controls you can harden afterwards
| What the breach touches | Can it be reset? | How |
|---|---|---|
| Medicare card number | Yes | Services Australia will issue a replacement card with a new issue number and expiry date, via myGov, the Express Plus Medicare app or by phone, and will transfer you to an entirely new card number on request |
| Your myGov password and sign-in method | Yes | Services Australia advises a password and PIN that are hard to guess and different from your other accounts, plus a stronger sign-in option such as the myGov Code Generator app |
| Access to your Services Australia records | Yes | A secret password added by phone or in person; online accounts, phone self service and apps can be locked, also by phone or in person |
| Your name, date of birth and address | No | No mechanism exists. Harden what they unlock instead |
| Your diagnosis, scans, results and clinical history | No | No mechanism exists, and none is possible |
| Who referred you and who is treating you | No | No mechanism exists. This is the pretext material |
Three rows have a remedy. Three do not, and the three that do not are the ones that make the next message believable.
So the honest summary of a health breach is that most of the damage is not repairable and the correct response is to change what you expect to arrive rather than to change what you hold. That is a less satisfying instruction than reset your password, and it is the true one.
How often this happens in Australia
Health is not an unlucky sector. It is the most affected sector, and it has been for years running.
Australian data breach notification figures, with the source and publication date for each
| Measure | Figure | Source and date |
|---|---|---|
| Data breach notifications received, calendar 2025 | 1,205, an 8 per cent increase over 2024 and the highest in any year since the scheme began in 2018 | Office of the Australian Information Commissioner, 6 July 2026 |
| Notifications from health service providers, 2025 | 225, or 19 per cent of the total — the most affected sector | Office of the Australian Information Commissioner, 6 July 2026 |
| Notifications attributed to malicious or criminal activity, 2025 | 716 of the 1,205 | Office of the Australian Information Commissioner, 6 July 2026 |
| Australians concerned about data breaches | 82 per cent, up from 74 per cent in 2023 | Australian Community Attitudes to Privacy Survey 2026, via the Information Commissioner, 6 July 2026 |
| Cybercrime reports received | Over 84,700 in 2024–25, an average of one every six minutes | Australian Signals Directorate, 14 October 2025 |
| Average self-reported cost per report, individuals | $33,000, up 8 per cent | Australian Signals Directorate, 14 October 2025 |
| Total reported scam losses | $2.18 billion in calendar 2025 | ACCC, 30 March 2026 |
Two hundred and twenty-five notifications in a single year, from health providers alone. That is more than four a week, every week, and the great majority of them never make the news. The three in this article are the ones that did.
Take a second, still
It is the last fortnight of Cyber Security Action Month, and the national theme has not moved.
Take a second. Stay secure.
Department of Home Affairs, Cyber Security Action Month stakeholder toolkit
Two weeks ago we argued that the pause is not a nice habit sitting beside your real defences, it is the defence, because speed is the mechanism every scam depends on. That was the piece on why every scam needs you in a hurry.
This month's stories have steadily narrowed what the second is for. It is not for inspecting the message, because the message can be perfect and can arrive through the real app. It is not for working out which companies to trust, because the breach may be three suppliers removed from anyone you have ever dealt with. It is for one thing: not acting on what arrived, and going to find the organisation yourself.
Which is a small habit with an unglamorous justification. It does not require you to detect anything.
If you think you have been caught
Quickly, and in this order.
- Contact your bank straight away if money has moved, and tell them it was a scam. Ask them to try to recall the payment and stop any card involved. Minutes genuinely matter here.
- Ring IDCARE on 1800 595 160, or +61 7 3555 5900 from outside Australia. It is free, it is a registered Australian and New Zealand charity and the national identity and cyber support service, and it will work out what to do next with you rather than sell you something. For a health breach with identity documents in it, this is the call to make.
- Replace your Medicare card, and ask to transfer to a new card number, through myGov, the Express Plus Medicare app or by phone, if your Medicare details were involved.
- Change the password on your email first, then on anything that shared it, and turn on multi-factor authentication while you are in there.
- Report it to Scamwatch at scamwatch.gov.au. It is quick, and it is what the alerts are built from.
And the thing worth saying every time: being caught by one of these is not a character flaw. A single extra letter in an email address, sent after a settlement agent's account was compromised, nearly took $1.2 million off a first-home buyer in Western Australia, and what stopped it was not her own vigilance but a banker who paused over the tone of a message. The people in this week's stories were having scans, seeing a neurologist, being treated for cancer. There is no lapse in judgement available in any of that.
If you want to know which of your details are already circulating before you decide what to harden, that is what our Digital Identity Health Check is for.
Related reading
- Why stolen health data isn't like stolen card details
- Driver's licence in a data breach? You can switch it off
- Why do scammers know your name and address?
Sources
- Icon Group, Important notification — data breach incident, 12 October 2026, updated 15 October 2026
- Cyber Daily, Australian patient data compromised in Icon Cancer Centre hack, 12 October 2026, for the forum seller's claims
- ABC News, Group of individuals impacted by data breach at SA hospital, 8 October 2026
- Cyber Daily, Hunter Neurology investigating patient data breach claims, 15 October 2026
- Services Australia, How you can protect your personal information after a data breach, for the Medicare replacement, the secret password and account locking
- Services Australia, Help if a scam or identity theft has affected you, for the Scams and Identity Theft Helpdesk
- Office of the Australian Information Commissioner, Data breach notifications increase to all-time high in 2025, 6 July 2026
- Office of the Australian Information Commissioner, Data breach report highlights supply chain risks, 22 February 2024, for the secondary notification figures and the Commissioner's quote
- Scamwatch, Scam alert: Qantas impersonation scam, 9 February 2026
- Minister for Defence, Annual Cyber Threat Report highlights persistent threat to individuals and across the Australian economy, 14 October 2025, for the Australian Signals Directorate figures
- ACCC, Continued action critical to combat fraud as annual scam losses exceed $2 billion, 30 March 2026
- Department of Home Affairs, Cyber Security Action Month 2026 stakeholder toolkit
- IDCARE, the national identity and cyber support service, a registered Australian and New Zealand charity
