A cyber-attack at one of Australia’s biggest healthcare providers, Partnered Health, has put the medical records and patient information of Australians at risk of being sold on the dark web. The attack, which occurred on June 23, affected 21 clinics across several cities, including Sydney, Melbourne, and Canberra. According to Partnered Health, a ‘malicious actor’ accessed its data, stealing medical information such as treatment details, consultation notes, referral letters, and pathology or diagnostic results.
Additionally, Medicare numbers, private health insurance details, names, dates of birth, addresses, and more were compromised. While patients and stakeholders affected by the breach have been contacted, a Partnered Health spokesperson stated that it was not in its patients’ interests to publicly discuss the number of people affected. The University of Melbourne’s Dr Suelette Dreyfus warned that personal medical information is particularly valuable, selling for up to US$250 per record on the dark web.
This information can be matched with other datasets, creating a detailed profile of an individual and potentially putting their privacy at risk. Dreyfus also noted that the risk of identity theft and disruption to a person’s life is substantial, especially for those with long-term medical conditions. Unlike financial data breaches, where victims can mitigate potential damage by changing passwords and credit cards, those who lose their medical records have limited recourse.
Dreyfus urged Australians to stay vigilant about any unusual activity in their accounts, ensure their devices have the latest security updates, and change their passwords regularly. She also called on governments and institutions to increase practical cybersecurity training, build public awareness, and support research to prevent attacks. This incident is not the first time Australians have had their data put at risk in a cyber-incident.
In 2022, the personal details of 9.7 million current and former Medibank customers were published on the dark web, and three years earlier, the Victorian auditor general exposed cybersecurity weaknesses in three hospitals. The incident has been reported to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and law enforcement. Dreyfus emphasized that medical institutions often prioritize patient privacy but may not always prioritize the cybersecurity element of their services.
She noted that while doctors and nurses are sensitive to patient privacy, they may not be equipped to handle wholesale data breaches. The incident highlights the need for increased cybersecurity measures in the healthcare sector to protect sensitive patient information.
