Loading story…
Australian telehealth provider Updoc notified patients that attackers gained unauthorized access to a third-party system supporting its operations, potentially exposing customer names, email addresses, and postal addresses. The company said it detected the incident on July 31, contained and isolated the affected environment, and reported that its own internal systems were not compromised.
Updoc said no health records, financial information, or payment details were affected, but warned customers to remain alert for scam attempts and fraudulent communications linked to the breach. The company has engaged external cybersecurity experts to investigate and has notified relevant law enforcement authorities, while the identity of the threat actor, the intrusion method, and the third-party provider involved have not been disclosed.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Updoc said it identified a brief period of unauthorized access to a third-party system used to support its operations. The potentially exposed data included customer names, email addresses, and postal addresses, while Updoc said its own systems and health, financial, and payment data were not affected.
Updoc notified patients that their personal information may have been accessed in the breach involving the third-party system. The company warned affected users to stay alert for scam attempts and fraudulent communications related to the incident.
After discovering the incident, Updoc launched an investigation with external cybersecurity experts, secured the affected network, and notified relevant law enforcement authorities. The company said the incident was contained and isolated with no evidence of access after the initial event.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Partnered Health, an Australian healthcare provider operating family medical clinics, disclosed a cyberattack that exposed patient data from clinics across Sydney, Melbourne, Canberra and other cities. Reports indicate the intrusion affected at least 16 clinics, while Partnered Health said data was accessed from 21 clinics on 23 June. The compromised information is believed to include highly sensitive medical records such as treatment details, consultation notes, referral letters, pathology and diagnostic results, along with personal and insurance data including names, dates of birth, addresses, Medicare numbers and private health insurance details. The company said it had notified affected patients and stakeholders and reported the incident to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and law enforcement. Partnered Health also obtained an interim injunction from the New South Wales supreme court ordering that the accessed data not be used or published, but experts warned the records could still be traded on dark-web markets, where medical data is considered especially valuable.
Jul 20, 2026
QualDerm Partners, a Tennessee-based healthcare management company that supports dermatology practices, disclosed a cyberattack that exposed the personal and protected health information of more than **3.1 million** individuals. The company said it detected unusual activity on December 24 and later determined that an unauthorized actor accessed a limited number of internal systems between December 23 and December 24, 2025, and exfiltrated stored data. The stolen information reportedly included names, dates of birth, medical record numbers, treatment and diagnosis details, health insurance information, and driver’s license numbers, making the incident one of the larger recent healthcare data breaches. QualDerm notified the U.S. Department of Health and Human Services Office for Civil Rights, informed law enforcement and regulators, and began offering affected individuals complimentary identity protection and credit monitoring; the company did not publicly attribute the intrusion, disclose the volume of data taken, or say whether a ransom demand was involved.
Jun 29, 2026