Lead

A major cyber attack on one of Australia's largest healthcare providers has compromised the personal medical records of thousands of patients. Partnered Health, which operates clinics nationwide, has confirmed that a "malicious actor" accessed and stole sensitive information, including names, Medicare numbers, and consultation notes.

Cybersecurity experts warn that the stolen data could be sold on the dark web, given the high value of medical records. Meanwhile, the company faces criticism over a 22-day delay between detecting the breach and informing the public.

Coverage Comparison

Reports from ABC Australia and The Guardian describe the attack, but differ in key details. ABC Australia reports that 57 clinics were affected, while The Guardian's coverage cites 21 clinics in several cities. Additionally, ABC Australia lists 16 clinics where patient information may have been stolen, with five more under investigation.

The Guardian emphasizes the potential sale of medical records on the "hidden market," quoting an expert who notes that personal medical information can sell for up to US$250 per record, significantly higher than other personal data.

ABC Australia's reporting focuses on the delayed public notification, quoting a cybersecurity lecturer who called the delay "unacceptable" and noting that health companies should be required to disclose attacks within 48 hours.

Key Claims

  • Partnered Health was hit by a cyber attack, with personal medical records stolen, as reported by both ABC Australia and The Guardian.
  • According to ABC Australia, 57 clinics were affected, while The Guardian reports 21 clinics affected across several cities.
  • ABC Australia lists 16 clinics where patient information may have been stolen, plus five more under investigation.
  • Partnered Health has engaged cyber experts to assess the breach, as reported by ABC Australia.
  • An interim injunction was obtained from the Supreme Court of New South Wales to protect accessed data, reported by both outlets.
  • The Guardian reports that the breach was reported to the Australian Cyber Security Centre and law enforcement.
  • ABC Australia reports a 22-day delay between the hack and public notification, drawing criticism from a cybersecurity expert.
  • Bupa announced it was acquiring Partnered Health, as reported by The Guardian.

Perspectives

Partnered Health's Response

The company acknowledged the breach and expressed regret, stating it wanted to avoid causing undue concern by notifying the public before fully understanding the extent of the breach. It emphasized that investigations are complex and time-consuming, and it has taken legal steps to protect the stolen data.

Cybersecurity Experts

Experts like Dr. Fariha Jaigirdar and Dr. Suelette Dreyfus criticize the delayed notification, warning that hackers can cause significant damage within a short time. They highlight the unique value of medical records and the potential for identity theft or targeted scams, urging stricter disclosure requirements for health companies.