Partnered Health Notifies Patients of Cyberattack on 21 Clinics While Seeking Court Block on Data Use

Partnered Health notified patients on Wednesday that a cyberattack had stolen personal and medical information from 21 clinics in its network. The company said it became aware that a malicious actor had accessed its systems more than three weeks before the notification.

The stolen data includes diagnostic and pathology results, consultation notes, referral letters, home addresses, private health insurance details and Medicare information.

Clinics in Ultimo, Castle Hill, Sans Souci and Dural in Sydney were affected, along with sites in Victoria, Queensland, Western Australia and the ACT. Partnered Health said the extent of the breach remains unclear at five clinics, three in Western Australia and two in Victoria, where it continues to investigate what information may have been taken. It is not known how many patients were affected.

The company obtained an interim injunction from the NSW Supreme Court to prevent the data from being used or published. It has reported the incident to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and law enforcement.

Partnered Health, which was established in 2013 and operates 60 clinics across Australia, said in a message to customers that there is no direct evidence patient records were viewed.

“While there is no direct evidence that patient records have been viewed, as a precaution we have written to patients from these clinics to make them aware of this and provide details of steps that can be taken to protect their information,” a spokesperson wrote. “We understand that this sort of news can cause concern.