Loading story…
An Australian federal court imposed a landmark AU$5.8 million fine on Australian Clinical Labs (ACL) for its mishandling of a significant data breach at its Medlab Pathology unit. The penalty, equivalent to approximately $3.8 million USD, marks the first time Australia has issued a civil monetary fine under the Privacy Act of 1988 for a data privacy violation. The case originated from a February 2022 cyberattack by the Quantum Group, a cybercriminal gang, which targeted Medlab Pathology shortly after ACL acquired the company in December 2021. During the attack, Quantum Group executed both data encryption and exfiltration, compromising sensitive information belonging to 223,000 patients. In the immediate aftermath, ACL publicly stated that no data had been exfiltrated and that the incident did not constitute a notifiable data breach under Australian law. However, these assertions were contradicted by an alert from the Australian Cyber Security Centre on March 25, 2022, which indicated that intelligence from a trusted third party suggested Medlab had indeed been the victim of a ransomware incident. The court found that ACL failed to adequately secure patient data both before and after the breach, highlighting deficiencies in cybersecurity controls and incident response. The ruling emphasized that ACL's delayed and inaccurate breach notification further exacerbated the impact on affected individuals. The fine serves as a precedent for future enforcement of privacy regulations in Australia, signaling a stricter approach to corporate accountability in the healthcare sector. The breach exposed a range of personal and health information, raising concerns about the potential for identity theft and other forms of misuse. Regulatory authorities underscored the importance of timely and transparent communication with both regulators and affected patients in the wake of such incidents. The case also illustrates the growing legal and financial risks faced by organizations that fail to comply with data protection obligations. The court's decision is expected to influence how other Australian companies approach cybersecurity and privacy compliance. The incident has prompted calls for enhanced security measures and more robust breach notification processes across the healthcare industry. ACL's experience demonstrates the reputational and operational consequences of inadequate cyber risk management. The fine is intended not only as punishment but also as a deterrent to encourage better data stewardship. The outcome of this case is likely to shape future regulatory actions and industry practices regarding data privacy in Australia.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Australian authorities imposed what the reports describe as the country's first-ever fine under the Privacy Act in connection with a laboratory data breach. The available references do not provide additional incident details or a more specific event date beyond the publication date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Labcorp agreed to pay **$35 million** to settle class-action litigation tied to the 2018–2019 cyberattack on its former billing vendor, American Medical Collections Agency, operated by Retrieval-Masters Credit Bureau. Labcorp said the incident affected nearly **10.3 million patients** whose personal information had been sent to AMCA and was present in the vendor’s systems between August 2018 and March 2019. Exposed data included **Social Security numbers**, payment card information, and in some cases medical test names and diagnostic codes. Under the proposed settlement, eligible class members can seek reimbursement of documented losses of up to **$5,000**, an estimated pro-rata cash payment of about **$50**, and **two years of medical and healthcare information monitoring**. Labcorp denied wrongdoing, and a final fairness hearing is scheduled in New Jersey federal court on Aug. 20. The AMCA breach affected roughly **24 million people** across dozens of clients, also hit Quest Diagnostics and BioReference Laboratories, contributed to AMCA’s 2019 bankruptcy, and previously led to a 2021 multistate settlement with **41 state attorneys general**.
Jun 29, 2026
ALN Medical Management and Octapharma Plasma have agreed to pay a combined total of $6.5 million to settle class action lawsuits stemming from separate cyberattacks that occurred in 2024. ALN Medical Management, a Nebraska-based revenue cycle management firm acquired by Health Prime in 2023, experienced a significant cyber incident in March 2024. Initially, ALN reported the breach to U.S. federal regulators as affecting only 501 individuals, but subsequent investigations revealed the true impact was much larger, with court documents indicating approximately 1.8 million people were affected. The company has agreed to pay $4 million to resolve the proposed class action lawsuit related to this breach. The breach was reported as a HIPAA data breach, highlighting the exposure of sensitive healthcare information. The settlement is pending a preliminary court hearing, with the date yet to be determined. Octapharma Plasma, a Swiss-based pharmaceutical manufacturer with blood plasma collection centers in the United States, was also targeted in a separate cyberattack in April 2024. In response to the resulting class action litigation, Octapharma Plasma has agreed to pay $2.55 million to settle claims from affected individuals. Both companies are among the latest in the healthcare sector to face multimillion dollar settlements following major hacking incidents. The breaches underscore the ongoing risks to patient data and the significant financial and reputational consequences for healthcare organizations. The settlements reflect the growing trend of legal action and regulatory scrutiny following large-scale data breaches in the healthcare industry. Both incidents involved the compromise of sensitive personal and health information, leading to widespread notification and remediation efforts. The lawsuits alleged that the companies failed to adequately protect patient data, resulting in unauthorized access and potential misuse of information. The settlements are intended to compensate affected individuals and cover costs related to credit monitoring and identity protection. These cases highlight the importance of robust cybersecurity measures and incident response planning for healthcare organizations. The financial impact of the settlements serves as a warning to other entities in the sector about the potential costs of inadequate data protection. The incidents have prompted calls for increased investment in cybersecurity and compliance with data privacy regulations. Both ALN Medical Management and Octapharma Plasma have taken steps to address the vulnerabilities exploited in the attacks and to enhance their security postures moving forward. The legal outcomes may influence future litigation and regulatory actions in the healthcare industry regarding data breaches.
Jul 12, 2026
France’s data-protection authority, CNIL, fined Hôpital privé de la Loire (HPL) **€500,000** over a 2025 breach in which an attacker used a compromised doctor’s account to access its electronic patient-record system. The incident exposed sensitive data for 524,867 patients and 202,246 trusted third parties—more than **727,000 people** in total. A person using the alias “Marak” claimed responsibility; three suspects were arrested in late June in connection with attacks on automated data-processing systems. CNIL found that HPL allowed remote access without a VPN or multifactor authentication, assigned overly broad permissions that enabled one compromised account to reach all patient records, and lacked monitoring capable of promptly detecting prolonged exploration and exfiltration. The authority also found that HPL failed to directly notify affected third parties, violating GDPR Articles 32 and 34. HPL has been ordered to correct the identified deficiencies within deadlines ranging from three to 15 months.
Sep 4, 2026