I-MED Radiology Network

Data exposed

Patient names, dates of birth, sex, addresses, scan type and date, referring physician, and some medical reports and scan images (as reported; 'tens of thousands of patients' is a media estimate). I-MED said its preliminary investigation did not indicate significant unusual access to patient records Media-reported

Confidence: Confirmed = regulator/court · Company-confirmed = the organisation's own disclosure · Media-reported = press. Figures without an official source are labelled, not estimated.

What happened

In September 2024 Crikey reported that patient files from I-MED Radiology Network — Australia’s largest medical imaging provider — had been accessible through its patient portal using login details shared online [crikey-imed], [malwarebytes-imed]. Reporting described the exposed information as including patient names, dates of birth, sex, addresses, scan type and date, referring physician, and in some cases medical reports and scan images, and estimated that tens of thousands of patients were involved [crikey-imed]. I-MED said its preliminary investigation did not indicate significant unusual access to patient records, that fewer than 10 accounts had been leaked, and that it had informed the OAIC [crikey-imed]. The number of individuals affected was not officially quantified and is not estimated here.

Timeline

2024-09-26 — Exposure of I-MED patient files reported; I-MED said it had informed the OAIC [crikey-imed].
2024-10 — Further reporting on the exposure [malwarebytes-imed].

Current status

Disclosed. No regulator investigation or finding about this incident has been published. Figures are as reported. [crikey-imed]

Why it matters

Diagnostic imaging is some of the most sensitive health data there is, and a single national provider holds it for a very large share of the population.