What happened
Partnered Health, which operates a national network of general-practice clinics, disclosed on 15 July 2026 that a malicious actor accessed its systems and took personal information — including health information — from a number of clinics in its network. It discovered the access on 23 June 2026 [ph-disclosure], [sbs-ph]. Its incident page lists 22 impacted practices across NSW, Victoria, Queensland, WA and the ACT [ph-disclosure]; earlier reporting had named 21 [ib-ph]. The provider says it obtained an interim injunction from the Supreme Court of New South Wales ordering that the accessed data is not used or published [ph-disclosure], [acsm].
Data exposed
Per the provider’s disclosure, information taken may include names, dates of birth, addresses and contact details; Medicare numbers; private health insurance, DVA Veteran Card or concession card numbers; and, for some patients, clinical data [ph-disclosure]. The number of people affected has not been disclosed and is not estimated here.
Timeline
- 2026-06-23 — Partnered Health discovered unauthorised access [ph-disclosure].
- 2026-07-15 — Public disclosure; ACSC, OAIC and law enforcement notified [ph-disclosure], [sbs-ph].
- 2026-07 — Interim injunction from the NSW Supreme Court, per the provider [ph-disclosure], [acsm].
- 2026-07-17 — Reporting named 21 affected clinics [ib-ph].
- 2026-07-30 — The INC Ransom group claimed the attack on its leak site and posted 11 files; Partnered Health said it was reviewing the material to assess its authenticity, and that additional Indooroopilly patients and some employees were being notified [cyberdaily-ph-inc], [ph-disclosure].
Current status
Disclosed. Regulators have been notified; no regulator finding has been published. The INC Ransom listing is a threat-actor claim and is not treated as fact. The number of people affected has not been disclosed [cyberdaily-ph-inc].
Why it matters
Primary-care networks concentrate exactly the data attackers want — Medicare and insurance identifiers alongside clinical notes. Nothing here is asserted beyond the provider’s statement and the reporting.