A major Australian healthcare provider has told patients their personal medical records were taken in a troubling cyber attack affecting part of its national clinic network.
Partnered Health Group, which operates more than 60 clinics across Australia including general practices and skin cancer centres, said on Wednesday that a “malicious actor” accessed data on June 23.
More than three weeks after the breach, the company said: “Our investigations to date have confirmed that personal information (including health information) was taken from some of the clinics in our network,” Partnered Health said, more than three weeks after the attack.
It said inquiries were still underway to determine the full extent of the breach and that affected patients were being contacted. “We are continuing to investigate the extent to which personal information has been impacted by this incident and are communicating with patients from impacted clinics.
The information believed to have been taken may include names, date of births, addresses and contact details, Medicare numbers, private health insurance, medical information and treatment details.
Partnered Health apologised over the breach, saying: “As a health services provider, we know our patients and our people trust us with personal and medical information and we sincerely apologise for any concern and inconvenience this may cause them,” Partnered Health said.
The company said the incident had been reported the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and police, “and we are continuing to work with the authorities”.
It has also obtained an interim injunction from the NSW Supreme Court to prevent the accessed data from being used or published.
Partnered Health said 21 practices may have been caught up in the cyber intrusion and added that the impact “differs across our clinics”. The listed centres are:
- Blackburn Road Medical Centre
- Broadway General Practice
- Bundall Medical Centre
- Cardiff Medical Centre and Skin Cancer Clinic
- Castle Hill Family Doctors
- Champion Drive Medical Centre
- Chancellor Park Family Medical Practice
- Dromana Family Doctors
- Dural Medical Centre
- Joondalup City Medical Group
- Kealba Family Practice
- Mornington Family Doctors
- Noosaville Seven Day Medical Centre
- North Canberra Family Practice
- Park Beach Family Practice
- Park Orchards Family Practice
- Rockingham City Family Practice
- Sans Souci Medical Practice
- Templestowe District Medical Centre
- Wentworth Avenue Family Practice
- Wyong Family Practice
The provider said clinics not included on the list are not impacted, “based on our current investigation”.
Partnered Health has set up a dedicated support page outlining steps patients can take to help protect their information. Patients have been urged to stay alert for suspicious emails, text messages and phone calls, and warned not to click on links or open attachments in messages that appear unusual or unexpected. They have also been advised to use strong, unique passwords across all accounts.
The attack was disclosed five days after insurance giant Bupa agreed to buy Partnered Health Group and its national network of general practices, skin cancer, allied health and mental health clinics.
That acquisition remains subject to ACCC and Foreign Investment Review Board approval, and will included the Jobfit, Baseline Onsite, New View Psychology, NewPsych Psychology, and Australian EAP brands.
