Hackers Hit 21 Australian Health Clinics, Putting Medicare Numbers and Test Results at Risk

Key points

• A "malicious actor" broke into Partnered Health's systems on 23 June, the company confirmed.
• 21 clinics across Sydney, Melbourne and Canberra were affected.
• Stolen data includes Medicare numbers, treatment details and pathology results (the results of blood tests and other laboratory work).
• The records could be sold on dark-web markets, hidden online spaces criminals use to trade stolen data.
• Partnered Health is one of Australia's largest healthcare providers.

A criminal broke into the computer systems of Partnered Health, one of Australia's biggest healthcare companies, and walked out with patient Medicare numbers, treatment histories and pathology results. The company confirmed the attack happened on 23 June, affecting 21 clinics.

This fits a pattern we've been tracking: our 10 July story found that attacks on healthcare vendors surged 110% in a year, with criminals betting that one breach can unlock records for hundreds of patients at once.

Could stolen medical records end up for sale?

Yes, according to cybersecurity experts cited by Guardian Australia. The records could appear on dark-web markets, parts of the internet ordinary browsers can't reach, where criminals trade stolen data.

Medical records are especially valuable. They carry enough personal detail to open fraudulent accounts or make fake insurance claims. Unlike a password, you can't simply change your Medicare number.

Partnered Health used the phrase "malicious actor" in its disclosure, standard corporate language for an outside criminal who deliberately broke in. No specific group or method has been named.

Should you worry?

If you're a patient at one of the 21 affected clinics, you should assume your information may have been taken. Watch for unexpected letters or calls from Medicare, unfamiliar charges on health-related accounts, or anyone contacting you claiming to be from the clinic and asking for further details. Report anything suspicious to Services Australia, which runs the Medicare program.

Organisations holding medical data face strict obligations under the Australian Privacy Act: they must notify affected individuals and the Office of the Australian Information Commissioner when a breach is likely to cause serious harm. Whether Partnered Health has met those notification requirements, and on what timeline, is something the regulator will likely examine.

The thing to watch here isn't just this breach. It's whether Australia's privacy regulator pushes for a faster, more specific notification standard. The current rules say "likely serious harm" but leave companies wide discretion on timing, and that gap is exactly where patients get left behind.