Loading story…
Partnered Health, an Australian healthcare provider operating family medical clinics, disclosed a cyberattack that exposed patient data from clinics across Sydney, Melbourne, Canberra and other cities. Reports indicate the intrusion affected at least 16 clinics, while Partnered Health said data was accessed from 21 clinics on 23 June. The compromised information is believed to include highly sensitive medical records such as treatment details, consultation notes, referral letters, pathology and diagnostic results, along with personal and insurance data including names, dates of birth, addresses, Medicare numbers and private health insurance details.
The company said it had notified affected patients and stakeholders and reported the incident to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and law enforcement. Partnered Health also obtained an interim injunction from the New South Wales supreme court ordering that the accessed data not be used or published, but experts warned the records could still be traded on dark-web markets, where medical data is considered especially valuable.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Partnered Health obtained an interim injunction from the New South Wales supreme court ordering that the accessed data not be used or published. The legal step was taken in response to the breach and risk of further dissemination.
After discovering the incident, Partnered Health said it contacted affected patients and stakeholders. The company also reported the breach to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and law enforcement.
Media reports said Partnered Health was the victim of a cyber breach exposing patient data across Australian family clinics. One report stated that 16 clinics were directly affected, while later reporting said 21 clinics were impacted.
Partnered Health said investigations were still ongoing at five clinics to determine the full extent of the June 23 cyberattack. This indicated the final scope of the compromise had not yet been fully established when the breach was disclosed.
On 2026-06-23, a malicious actor accessed data from 21 Partnered Health clinics across Sydney, Melbourne, Canberra, and other Australian cities. The compromised data is believed to include sensitive medical records, consultation notes, diagnostic results, and personal and insurance information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcescworld.com
Open sourcetheguardian.com
Open sourceteiss.co.uk
Open sourcemalware.news
Open sourcepartneredhealth.com.au
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Medibank said attackers accessed personal data belonging to all of its customers and some authorized representatives, affecting about **9.7 million** current and former customers. The Australian health insurer said the compromised information included identifying details and health claims data for roughly **480,000** customers, and warned that all accessed data may have been stolen. Medibank later said it would **not pay the ransom**, citing expert advice that payment would not ensure the return of data or prevent its publication, while Australian officials backed the decision and warned that ransom payments fuel further extortion. In Romania, hospitals were forced offline after a ransomware attack hit a healthcare IT platform used by multiple medical facilities, disrupting operations across the country. Reporting indicated the crisis was linked to a **third-party incident**, underscoring how attacks on shared service providers can cascade across healthcare organizations. Together, the incidents highlight how cybercriminals are targeting healthcare entities through both direct intrusions and attacks on critical external platforms, exposing sensitive patient data and interrupting care delivery.
Jun 29, 2026
A cyberattack on ManageMyHealth, a major New Zealand patient portal, compromised the sensitive health data of an estimated 6-7% of its 1.85 million users, affecting over 100,000 individuals. The breach prompted the New Zealand government to launch a formal review into the incident, focusing on its cause, scope, and the adequacy of the company’s security measures. ManageMyHealth has stated that the incident is now contained and is working with cybersecurity experts, law enforcement, and regulatory bodies to assess the full impact and strengthen its defenses. In response to the breach, ManageMyHealth obtained a High Court injunction to prohibit the sharing of any stolen data, though the effectiveness of this legal measure remains uncertain, especially regarding international actors. Health New Zealand and General Practice New Zealand are coordinating a national response, and affected patients are being directly notified. The breach has raised significant concerns about the protection of highly sensitive health information and the need for improved security standards across both public and private healthcare data handlers in New Zealand.
Jun 29, 2026