Cyberattack on Partnered Health GP clinics exposes patient data

Consensus Summary

A major cyber breach at Partnered Health, one of Australia’s largest GP clinic networks, exposed sensitive medical records and personal data from 21 clinics nationwide. The attack was confirmed on June 23, with stolen information including names, Medicare numbers, private health insurance details, and medical records such as consultation notes and pathology results. Partnered Health, which operates more than 60 clinics across Australia, obtained a court injunction to prevent the leaked data from being published or used, though experts warn it may still appear on the dark web. The breach has raised concerns about patient privacy and the vulnerability of Australia’s healthcare sector to cyber threats.

The incident follows a broader trend of rising data breaches in Australia, with the Office of the Australian Information Commissioner reporting 1,205 breach notifications in 2025—an 8% increase from the previous year. Health providers were the largest source of these breaches, underscoring the sector’s susceptibility to cyberattacks. Partnered Health, established in 2013, has faced criticism for its delayed public disclosure, with cybersecurity experts calling the three-week delay between detection and notification ‘unacceptable.’ The company has since established a support page for affected patients and is working with government agencies, including the Australian Cyber Security Centre and law enforcement, to investigate the breach’s origins.

Key figures involved include Partnered Health’s management, which has apologized for the breach and emphasized its efforts to protect patient data. Cybersecurity experts, such as Dr. Fariha Jaigirdar from Deakin University and Dr. Suelette Dreyfus from the University of Melbourne, have warned about the long-term risks of stolen medical records, which can be sold on the dark web for hundreds of dollars per record. The Guardian notes that unlike financial data breaches, victims of medical record theft have limited recourse, as their medical history cannot be altered. Meanwhile, the ABC reports that Partnered Health is in the process of being acquired by Bupa, adding another layer of scrutiny to its cybersecurity practices.

While the core details of the breach are consistent across sources, discrepancies exist in the number of clinics affected and the total number of clinics operated by Partnered Health. The ABC specifies 57 clinics with 16 confirmed impacted and another five under investigation, whereas the SMH and Guardian state 21 clinics were affected without further breakdowns. Additionally, the ABC highlights a 22-day delay in notifying patients, while the SMH frames the delay as ‘more than three weeks.’ These differences reflect varying emphases in reporting but do not contradict the fundamental facts of the breach itself.

The immediate aftermath of the breach includes ongoing investigations into the extent of the data theft, particularly at five clinics where evidence is still being assessed. Partnered Health has urged patients to remain vigilant for scams and has taken legal steps to mitigate further damage. Experts, including those cited by the Guardian, have called for stricter cybersecurity measures across the healthcare sector, noting that medical data is particularly valuable to cybercriminals. As the investigation continues, the focus remains on preventing similar breaches in the future and protecting the millions of Australians whose personal information may have been compromised.