SteadyPoint Cyber
23 July 2026 · SteadyPoint Cyber

Take a Seat, the Hacker Will See You Now

If you have visited a GP lately at somewhere like Dromana Family Doctors, Wyong Family Practice or Castle Hill Family Doctors, you may have received an unwelcome message in the past week. Those clinics, along with 18 others across NSW, Victoria, Queensland, WA and the ACT, sit under a company called Partnered Health, which operates more than 60 healthcare clinics around the country. In mid-July the company confirmed that a malicious actor had been inside its network and had taken patient data from at least 21 of its general practices.

The intrusion was detected on 23 June. Partnered Health brought in specialist cyber experts, contained the incident, and spent the next three weeks working out what had been taken before patients started hearing about it. The answer was quite a lot, including names, email addresses, dates of birth and home addresses, along with Medicare numbers, private health insurance details and Veteran Card numbers. The attacker may also have accessed consultation notes, referral letters and pathology results, which is the conversation you had with your doctor sitting on someone else's hard drive. The company obtained an injunction from the Supreme Court of NSW ordering that the data not be used or published, and the people who stole it will presumably read the order carefully and govern themselves accordingly.

Update, October 2026: On 30 July the extortion group INC Ransom listed Partnered Health on its leak site, and the company says the group published 11 files it claims contain personal information. Partnered Health said it was urgently reviewing the material, that the publication was not a new incident, and that it had also identified more patients and some staff from its Indooroopilly practice who may be affected. The group runs a rental model, supplying its software to affiliates who keep a share of whatever they extract.

Why this matters to your business

The clinics on that list are not hospitals with IT departments. They are suburban family practices of the kind that share a shopping strip with a bakery and a physio, and none of them was individually targeted. They were affected because they plugged into a parent company's shared systems, and when those systems were compromised all 21 were compromised together.

Think of a central kitchen supplying twenty-one cafes. Each cafe has its own staff, its own apron and its own reputation with the regulars, but the same batch of mayonnaise arrives at every door, and when it turns out to be contaminated all twenty-one close on the same afternoon. The cafes did nothing wrong and it makes no difference to them. Most small businesses sit at the end of a supply line like this without realising it, because your real exposure includes every practice management platform, bookkeeper, IT provider and head office you connect to.

The other lesson is about time, because even with professional responders on the job, three weeks passed between detection and patients being told. Stolen medical records are particularly unpleasant because a diagnosis cannot be cancelled and reissued the way a credit card can.

Three things to actually do this week for reassurance

  1. Map your data custodians. Write down every third party that holds your customer data, including software platforms, a franchisor or head office, your accountant and your marketing tools, then ask the important ones one question: if you are breached, when and how do I find out?
  2. Check your notification obligations. If your business handles health information, the Notifiable Data Breaches scheme applies to you whatever your turnover. Have a one-page plan for who you would call in the first 48 hours, starting with your insurer and the OAIC.
  3. Delete what you do not need. Old ID scans, stale patient or customer records and ex-staff files all count, because data you no longer hold is data nobody can steal from you.

By the numbers

This week's odds

Which of these would you actually bother worrying about?

Pick a card to see the odds of it happening to you in a given year. Then see where your business sits.

0 of 4 revealed

Sources

Sources for the odds graphic

    ← All posts