Brisbane Medical Clinic Took Three Months to Tell Patients Their Emails Were Read by Hackers

Key points

• GO2 Health, a general practice and veteran care clinic in Everton Park, Brisbane, confirmed its main email inbox was accessed in April 2024 via a phishing attack, where criminals sent fake emails to trick staff into handing over access.
• Patients' Department of Veterans' Affairs (DVA) ID numbers and other personal information sent to the inbox during the previous 12 months were potentially read by the hackers.
• The clinic notified Australia's privacy regulator, the Office of the Australian Information Commissioner (OAIC), on 18 May, but affected patients did not receive a warning until 16 July.
• Australian law requires organisations to alert the OAIC within 30 days if a breach is likely to cause serious harm, but sets no equivalent deadline for notifying the people whose data was exposed.

A Brisbane medical clinic waited nearly three months to tell patients that criminals had read their private emails, ABC News Australia reported this week. It's the second such disclosure in a week: our story on 19 July covered how Partnered Health sat on a serious data theft for 22 days before telling anyone.

A staff member was tricked into handing over access to GO2 Health's main inbox sometime in April. The clinic says it contained the breach and alerted affected staff on 24 April.

Why did patients wait so long to find out?

GO2 Health says it needed time to identify exactly which patients' information sat inside the inbox. The clinic told ABC News Australia it did not want to alarm the wrong people or send inaccurate information. It reported to the OAIC on 18 May, within the 30-day window the Privacy Act sets, and sent patient notifications on 16 July.

That gap troubles at least one affected patient. Amanda, a veteran receiving psychological treatment at the clinic, says the delay cost people a chance to act.

"I think they've wasted really precious time for people to check their accounts and change their passwords," she told ABC News Australia.

Core patient records were not breached. The exposed data came only from emails sent during the 12 months before the attack, because the inbox auto-archives and deletes older messages. Amanda says veteran patients routinely send sensitive mental-health and DVA claims material by email, meaning a full year of that information was potentially exposed. She has since applied to change her Medicare number and asked GO2 Health whether she needs a new DVA card; she had not received a reply at publication time.

Should you worry if you received a notification?

If GO2 Health contacted you, four steps are worth taking. Change the password on any email account you used to contact the clinic. Contact Services Australia to ask about replacing your Medicare card. Reach out to the Department of Veterans' Affairs if your DVA number appeared in any email to the clinic. Watch for unexpected calls or letters asking for personal details, which can signal that stolen information is already being used.

Does the law need to change?

Australia's Notifiable Data Breaches scheme, set out in Part IIIC of the Privacy Act 1988, draws a hard line at 30 days for telling the regulator but leaves patient notification timing entirely to the organisation's judgement. Cybersecurity experts have called for rules requiring clinics to warn patients early in an investigation rather than after it concludes. The GO2 Health delay, nearly twice as long as the Partnered Health gap that experts already labelled unacceptable, makes that argument harder to dismiss. For patients, the practical problem is simple: every week without notice is a week stolen data can be used before anyone thinks to check.