Cyber-Attack Compromises Patient Data at Partnered Health Clinics
Thousands of medical records and patient details held by one of Australia's largest healthcare providers have been compromised in a cyber-attack.
Partnered Health, which is owned by private equity firm Quadrant, reported that 21 clinics located in multiple cities including Sydney, Melbourne, and Canberra were impacted by the breach that took place on 23 June.
“Our investigations to date have confirmed that personal information (including health information) was taken from some of the clinics in our network,”
the healthcare provider stated on Wednesday.
“As a health services provider, we know our patients and our people trust us with personal and medical information and we sincerely apologise for any concern and inconvenience this may cause them.”
The healthcare group revealed that a "malicious actor" accessed the data, which led to the incident being reported to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and law enforcement agencies.
The compromised personal information included names, dates of birth, addresses, and contact details, as well as Medicare, private health insurance, and concession card information.
Additionally, medical information and treatment details were breached. This included consultation notes, referral letters, and pathology or diagnostic results recorded by general practitioners.
In response, the medical group has sought an interim injunction from the Supreme Court of New South Wales to prevent the accessed data from being used or published.
Partnered Health's Profile and Industry Context
Founded in 2013, Partnered Health operates over 60 medical centres nationwide, including skin cancer, allied health, and mental health clinics. Its services reach more than five million people across Australia.
In June, Bupa announced its acquisition of Partnered Health, marking the latest significant healthcare business to experience a cyber-attack.
Data breach notifications to the Office of the Australian Information Commissioner reached a record high in 2025, with major incidents compromising the details of 5.7 million customers. Some of this information was reportedly leaked on the dark web.
The office received 1,205 data breach notifications in the 2025 calendar year, representing an eight percent increase compared to 2024.
