{"id":804714,"date":"2026-07-16T21:08:18","date_gmt":"2026-07-16T21:08:18","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/804714\/"},"modified":"2026-07-16T21:08:18","modified_gmt":"2026-07-16T21:08:18","slug":"delay-in-revealing-partnered-health-breach-and-stolen-patient-data-unacceptable","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/804714\/","title":{"rendered":"Delay in revealing Partnered Health breach and stolen patient data ‘unacceptable’"},"content":{"rendered":"

A cybersecurity expert has labelled the delay between Partnered Health identifying it had been the target of a hack and notifying the public as “unacceptable”.<\/p>\n

The company, which runs more than 60 health clinics nationwide, said it first became aware a “malicious actor” had accessed data<\/a> from some of those clinics on June 23.<\/p>\n

The patient information obtained by the hackers potentially included names, dates of birth, addresses, Medicare numbers, treatment details and notes written by healthcare professionals during consultation.<\/p>\n

\"A<\/p>\n

Cardiff Medical Centre and Skin Cancer Clinic is one of 16 facilities believed to have been impacted in a cyber breach.\u00a0 (Supplied: Partnered Health Medical Centres\/Facebook)<\/p>\n

Partnered Health did not alert the public or those potentially impacted by the hack until yesterday.<\/p>\n

Fariha Jaigirdar, a lecturer in cybersecurity at Deakin University, said hackers can do a lot of damage in 22 days.<\/p>\n

“It takes one day, or even hours, for hackers to use a combination of the information that has been stolen to crack an individual’s system,” Dr Jaigirdar said.<\/p>\n

“Obviously this (delay) is not acceptable.”<\/p>\n

Partnered Health said it wanted to identify which of its clinics were impacted before alerting the public.<\/p>\n

“We wanted to avoid causing undue concern and confusion by notifying people before we had a reliable understanding of what had occurred and who was affected,” a spokesperson said.<\/p>\n

\"A<\/p>\n

Fariha Jaigirdar lectures in cybersecurity at Deakin University. (Supplied)<\/p>\n

“Investigations of this nature can be extremely complex and take time to complete accurately, and there is nothing to be gained by communicating inaccurate information regarding a serious incident such as this.”<\/p>\n

The early part of the investigation has determined that 21 clinics were impacted.<\/p>\n

The company said it would not comment on any correspondence received from the hackers during the investigation.<\/p>\n

‘Very scary’ information stolen<\/p>\n

Last year the Office of the Australian Information Commissioner received 1,205 data breach notifications.<\/p>\n

Health providers were the single largest source of those notifications, reporting more than 200 breaches.<\/p>\n

Dr Jaigirdar said this is because the information they keep is both highly sensitive and very useful.<\/p>\n

“The information that has been stolen is very scary,” she said.<\/p>\n

\"A<\/p>\n

Health providers reported more than 200 data breaches last year.<\/p>\n

“(The hackers) can use it for a combination of things, such as creating usernames and passwords.<\/p>\n

“(To create passwords) people sometimes use a combination of their name, address and Medicare number.”<\/p>\n

Given the potency of the information they hold, Dr Jaigirdar said health companies should be required to disclose that they were victims of a cyber attack within 48 hours.<\/p>\n

While not all those subsequently notified would have had their data stolen, she said changing passwords as a precaution was preferable to having a bank account accessed.<\/p>\n

A serious erosion of trust<\/p>\n

Christopher Rudge, an expert in health law at the University of Sydney, was one of those who received a message from his medical clinic telling him his information had potentially been accessed.<\/p>\n

He said the fact that doctor’s notes might have been accessed was particularly distressing.<\/p>\n

“What did I tell the GP and what is out there in the world now?” he said.<\/p>\n

“What will I tell GPs in the future?<\/p>\n

“Once trust is eroded or diminished, it can have knock on effects on the health system.”<\/p>\n

He described the relationship between a doctor and patients as “akin to priest and parishioner” but said the old rules around confidentiality were breaking down.<\/p>\n

\"Man<\/p>\n

Christopher Rudge, a lecturer in law at the University of Sydney. (Supplied: Maja Baska)<\/p>\n

“In the modern digital world, the practitioner can do everything in their power to secure documents, but the system itself is vulnerable.<\/p>\n

“It’s a sign of how archaic our old notions of confidentiality have become.”<\/p>\n

Partnered Health successfully applied for an injunction preventing anyone in Australia from publishing information obtained through the hack.<\/p>\n

But Dr Rudge said this would have limited practical effect.<\/p>\n

“The problem is, of course, that things are published online anonymously and published in areas of the internet that are very hard to police.<\/p>\n

“The injunction is very easy to get, but the level of protection that it gives to those who have had their data breached is very low.”<\/p>\n

He said every effort needed to be made to prevent data being taken in the first place.<\/p>\n

Partnered Health has established a support page for impacted patients.<\/p>\n","protected":false},"excerpt":{"rendered":"A cybersecurity expert has labelled the delay between Partnered Health identifying it had been the target of a…\n","protected":false},"author":2,"featured_media":804715,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[64,63,99,43671,43674,43851,377958,38823,8886,7535,375982,94,701],"class_list":["post-804714","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-au","tag-australia","tag-business","tag-cyber-attack","tag-cyber-crime","tag-cyber-security","tag-gp-network","tag-hackers","tag-hacking","tag-medical-records","tag-partnered-health","tag-qld","tag-queensland"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/804714","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=804714"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/804714\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/804715"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=804714"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=804714"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=804714"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}