Ochre Health (Tuggeranong)

Data exposed

Unauthorised access limited to two accounts on the HotDoc third-party booking platform (Tuggeranong clinic) Company-confirmed

Name, address, email, phone number, date of birth, gender and limited appointment/booking information (date and time, practitioner, consult type); no clinical records or treatment notes Company-confirmed

Claimed by a threat actor, not confirmed by Ochre: Medicare numbers, DVA numbers and billing information Media-reported

Confidence: Confirmed = regulator/court · Company-confirmed = the organisation's own disclosure · Media-reported = press. Figures without an official source are labelled, not estimated.

What happened

In June 2026 Ochre Health confirmed it was investigating claims that patient data from its Ochre Medical Centre Tuggeranong clinic in Canberra had been accessed [och-ochre]. The company said the access occurred through two user accounts on HotDoc, a third-party appointment-booking platform [och-ochre]. A threat actor claimed the dataset covered more than 25,000 patients and included Medicare numbers, DVA numbers and billing information [och-cyberdaily]; a separate claim relayed by the Canberra Times put the count at about 20,000 [och-canberratimes]. Ochre has not confirmed a count.

In its August 2026 update Ochre reported the outcome of its investigation: access was limited to the two HotDoc accounts, and the affected information was name, address, email, phone number, date of birth, gender and limited appointment/booking information. It said clinical records and treatment notes were not affected and that it had found no evidence of misuse [och-update5].

Timeline

2026-06 — Media reported a threat actor’s claim that patient data from the Tuggeranong clinic was circulating online [och-cyberdaily].
2026-06-15 — Ochre Health published a statement confirming unauthorised access via two HotDoc accounts and saying it was liaising with the OAIC and ACSC [och-ochre].
2026-07-17 — The Canberra Times reported a separate claim of about 20,000 records [och-canberratimes].
2026-08-28 — Ochre’s Update #5 reported the investigation outcome and confirmed the data types affected; the ACSC and OAIC have been informed [och-update5].

Current status

Disclosed. Ochre has confirmed the data types affected and says the ACSC and OAIC have been informed [och-update5]. The patient counts circulating are threat-actor claims, not confirmed by Ochre, so no count is asserted here [och-cyberdaily], [och-canberratimes].

Why it matters

GP-clinic booking systems hold identity and contact details on large patient populations, and this incident again turns on compromised accounts on a third-party platform rather than the clinic’s own systems.