What happened
In August 2023 the Victorian anatomical-pathology provider TissuPath was breached through a third-party IT provider, exposing scanned pathology referrals issued between 2011 and 2020 and the patient details on them — names, dates of birth, gender, contact details, Medicare and private health insurance details, and referring-doctor details [tp-cd], [tp-statement]. The referrals related to patients referred for suspected cancer. TissuPath said its billing information and the database storing patient diagnoses were not compromised [tp-statement]. TissuPath notified the OAIC and worked with the ACSC [tp-cd].
Timeline
- 2023-08-24 — Incident first noted when the threat actor made contact [tp-cd].
- 2023-08-25 — TissuPath notified referring doctors [tp-cd].
- 2023-09-04 — TissuPath issued its media statement [tp-statement].
- 2023-09-20 — ID Support NSW published guidance on the breach [tp-idsupport].
Current status
Disclosed. An attacker claimed a large volume of files; that is a file count, not a count of people, so no number of affected patients is asserted here.
Why it matters
Pathology referrals reveal why a patient is being tested; a supplier breach exposing them is a serious harm to the patients named.