Australia: Medical Data from 21 Clinics Stolen in Partnered Health Cyberattack

Herz — World Desk · 16 July 2026 at 08:35 · 30s summary · 2 min read

What we know

On June 23, 2026, a malicious actor accessed the systems of Partnered Health, operator of 21 medical clinics located in Sydney, Melbourne, and Canberra, Australia.

According to The Guardian, stolen data includes detailed medical information — consultation notes, referral letters, pathology and diagnostic results — as well as Medicare numbers, private health insurance details, patient names, dates of birth, and addresses.

Partnered Health declined to make public the number of affected individuals, arguing that disclosure would be contrary to patients' interests.

The incident was reported to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner — Australia's personal data protection authority — and law enforcement. Affected patients and stakeholders were contacted directly by the company.

Judicial response and its limitations

Partnered Health obtained a provisional injunction from the New South Wales Supreme Court prohibiting the use or publication of accessed data.

However, Dr. Suelette Dreyfus, senior lecturer in information systems at the University of Melbourne, warns that this injunction will likely be unable to prevent data sales on the dark web.

Medical data is particularly coveted

Medical records sell for up to $250 USD each on black markets, compared to a few cents for basic personal data such as a name or address, making them particularly lucrative targets for cybercriminals.

Context: Australia previously targeted in 2022

In 2022, the personal data of 9.7 million current and former Medibank customers was published on the dark web after the Australian health insurer refused to meet hackers' financial demands.

What remains uncertain

The exact number of patients whose data was compromised is unknown. Partnered Health declined to communicate this publicly. The specific nature of the Medicare identifier targeted in the Australian context is not detailed in available verified sources.