Do You Really Need Every File You've Ever Kept? A Dental Clinic's Leak Says No.

Brighton East Dental Clinic is the sort of practice you find in any suburb, doing general and children's dentistry, preventative work and dentures for the families who live within a few streets of it. On 12 August the extortion group INC Ransom named the clinic on its dark web leak site, and instead of starting the usual countdown it published 37 gigabytes of the practice's files the same day. Cyber Daily reported the contents on 18 August, and the clinic declined to comment.

What is in that 37 gigabytes explains why this one is different from the average leak site listing. One directory holds more than 600 folders, one per patient, containing referral letters, treatment details, dental X-rays and correspondence with specialist providers. Another holds employment contracts, signed consent forms, medical impact statements, the test results from the clinic's sterilisation equipment, and an audio recording of a patient being given a diagnosis. Cyber Daily reports the material runs from 2003 to 2025, so what is now on a criminal website is twenty-two years of a suburban practice's working life.

Nobody in that building decided to keep records on patients who last walked through the door in 2004. It happened because the software kept everything by default, the old files were carried across every time the system was upgraded, and deleting things has always felt riskier than keeping them. Most small businesses run on the same logic, so a more useful question than whether someone could get in is how many years of other people's information they would leave with if they did.

INC Ransom has been running since August 2023 and rents its software to affiliates who keep a cut of whatever they extract. One of those affiliates claimed the Partnered Health network of more than 60 clinics only a few weeks earlier, and two Australian healthcare victims from the same operation within a month, one a national group and one a single suburban practice, suggests the affiliates are working down a list and not choosing their targets with much care.

Why this matters if you run something small

If you run a health business of any size in this country, this is worth knowing. The small business exemption in the Privacy Act, which lets businesses under $3 million in turnover off the hook, does not apply to health service providers. A one-chair dental practice, a physio, a pharmacist and a sole-trader psychologist all carry the same obligations as a private hospital, including notifying the OAIC and the affected patients when a breach is likely to cause serious harm. Plenty of very small practices only discover this in the week they can least afford to be learning it.

Think of every business's records as a garage full of boxes. Nobody has opened most of them since the last move, but they are all still yours and still your problem on the day a thief takes them away in a ute. The sensible time to hire the skip bin is before that, when you can sort through at your own pace and decide what you really need to keep.

Three things to actually do this week

1. Ask whoever runs your systems how far back your data goes and why you are still holding it. Write down what you are legally required to keep and for how long, then get rid of the rest properly. Health and financial records carry real minimum retention periods, so check them and do not guess, but forever is almost never the right answer.
2. Assume publication, not just encryption. Extortion crews increasingly skip the locked-files stage and go straight to posting, so decide now who you would ring, what you would tell customers and which regulator needs to hear from you. For health information that regulator is the OAIC, and the assessment clock is 30 days.
3. Ask the same question of your suppliers. Your bookkeeper, your IT provider and whoever hosts your booking system all have retention habits, and their habits are your exposure. See the suggested email text at the very bottom of this page for this and 1. above.

By the numbers

• Cost of cybercrime to the average Australian small business: $56,600 AUD per incident, up 14% [ASD Annual Cyber Threat Report 2024-25]
• Data breach notifications to the OAIC in 2025: 1,205, the highest since the scheme began in 2018, with health the most-reported sector at 225 notifications or 19% [OAIC, published July 2026]
• Breaches involving ransomware: 48%, up from 44% the previous year, with 69% of ransomware victims not paying [Verizon Data Breach Investigations Report 2026]
• Small and medium businesses reporting a cyber incident in the past year: 1 in 5 [Australian Banking Association, reported by Cyber Daily, 1 September 2026]

Sources

• Exclusive: Patient data potentially compromised in alleged dental clinic data breach (Cyber Daily, 18 August 2026)
• Victim listing for BEDC.COM.AU (Ransomware.live)
• Exclusive: Partnered Health responds to INC Ransom data breach claims (Cyber Daily, 3 August 2026)
• Rights and responsibilities, including the small business exemption and health service providers (OAIC)
• Annual Cyber Threat Report 2024-25 fact sheet for businesses and organisations (ASD, October 2025)
• Data breach notifications increase to all time high in 2025 (OAIC, 6 July 2026)
• Verizon DBIR 2026 findings (Help Net Security, 20 May 2026)
• 4 in 5 SMEs report being exposed to scams (Cyber Daily, 1 September 2026)