Healthcare leads Australia's data breach notifications: what practices should check now

The notification figures come from the Office of the Australian Information Commissioner (OAIC). Of the 667 notifications it received from January to June 2026, 149 came from health service providers, ahead of education with 85.^[1] These are breaches reported under the Notifiable Data Breaches scheme, so they show what was notified. They do not capture every breach that occurred.

The Australian Signals Directorate (ASD) sees a similar pattern in the cyber incidents reported to it. In its Annual Cyber Threat Report 2025-26, the healthcare and social assistance sector became the most frequently reporting non-government sector, with 7 per cent of incidents. Healthcare was also one of the three sectors most affected by ransomware.^[2]

ASD's previous report shows how serious those incidents can be. In its 2024-25 report, ASD said malicious actors were successful in 95 per cent of healthcare and social assistance incidents to which it responded, compared with nearly 52 per cent across all sectors.^[3] This is not a measure of all attacks against healthcare, but it illustrates the seriousness of the incidents that reached ASD.

Three Australian incidents this year each came through a different route.

Inside a healthcare group. In June, a malicious actor accessed data held by Partnered Health, which owns 57 general practices and skin cancer clinics. At least 21 clinics in four states and the ACT were affected, and information taken from some included Medicare numbers, consultation notes, referral letters and pathology results.^[4] When systems and data are shared across a group, one incident can affect many practices at once.

Through a supplier. In October, Icon Cancer Centre reported unauthorised access to some patient information held on a supplier's system, after a hacker offered data for sale online.^[5][6] Icon said patient care and treatment were not affected.^[5] Even when care carries on as normal, the work after a breach like this is substantial. The organisation has to establish what was accessed and whose information it was, decide who needs to be told, and answer patients who want to know what it means for them.

Through a government scheme. In late October, data was taken from a server that runs NSW Health's Oral Health Fee for Service Scheme, which lets public dental patients get vouchers for treatment by private dentists. eHealth NSW said no patient data was involved, but a small number of provider details may have been stolen, possibly including sensitive documents.^[7] NSW Police said the stolen data included personal identification information about providers, mainly dentists.^[8] The affected organisation was NSW Health, but some of the exposed information related to private dental providers participating in the scheme. It is a useful reminder that information about a practice can be affected even when the practice's own systems were not accessed.

Your practice's information may sit with government schemes, pathology laboratories, practice management software providers, booking platforms and IT support companies. Some suppliers only hold information. Others can access your systems remotely or are essential to the practice's daily operations, and some may do all three. The practice should know which relationship applies, what information or access is involved, and what notification process applies if that information is accessed, lost or disclosed.

Each relationship carries a different risk. A supplier that holds information can lose it without anyone touching your systems. A supplier with remote access can become a way into your systems if its own accounts or tools are compromised. A supplier that runs a critical service can stop the practice working even when no information is lost.

Five questions to ask each key supplier:

1. What practice, staff and patient information do you hold?
2. Can your staff or subcontractors access our systems remotely?
3. How quickly will you notify us if our information or access credentials are affected?
4. Who is our escalation contact outside business hours?
5. What happens to our information when the service ends?

The last question deals with information a supplier no longer needs. As Privacy Commissioner Carly Kind said when the OAIC released its latest figures: "Organisations can't lose personal information they don't hold."^[1]

For the suppliers your clinical work and daily operations depend on, record the answers in the practice's supplier register or risk register, so there is something to hold them to when a contract is renewed or something goes wrong.

None of these needs technical knowledge to ask for. Ask your IT provider for the answers in writing.

1. Know what can be accessed from outside the practice. Ask your IT provider for a current list of systems that can be reached from outside the practice, including remote-access tools, cloud services and internet-facing devices such as firewalls. Confirm that each one has an owner, a business purpose and appropriate protection.
2. Agree patching timeframes. ASD has observed that most exploitation of security flaws happens within two weeks, and some flaws have been exploited within 48 hours of a fix or mitigation advice being released.^[2] Critical vulnerabilities affecting internet-facing systems should be assessed immediately and patched or otherwise mitigated as a priority. Routine updates should follow a documented schedule, with any delay recorded and managed. Some clinical software needs vendor approval before an update, so ask what protects it in the meantime.

   Fix released

   484848 hours

   Some flaws already exploited

   222 weeks

   Most exploitation has happened

3. Protect high-risk access first. Use multi-factor authentication (a code or app prompt as well as a password) wherever it is available, starting with email, remote access, administrator accounts and cloud services. Where a clinical system cannot support it, ask what other protections are in place. Remove access on the day a staff member or locum leaves, and check any request to reset a password or change bank details by calling back on a number you already hold.
4. Check supplier access. Identify every supplier that can access the practice's systems or data. Remove access that is no longer needed, and make remote access time-limited wherever possible, so it is switched on for a support job and off afterwards. Confirm how quickly each supplier will notify the practice of an incident.
5. Practise a systems-down morning. Walk through how the practice would operate if the practice management system, phones or online booking were unavailable at the start of the day. Ask your IT provider to demonstrate a successful restore from backup, and record what was restored, when it was tested, how long recovery took and whether the recovered information was usable. A backup only helps if recovery works within a time the practice can manage.

A downtime plan can be short, but it needs to be agreed in advance and kept somewhere that does not depend on the failed system. The practice manager is usually the person everyone turns to, so they should hold a printed copy with the key phone numbers.

Most private health service providers are covered by the Privacy Act regardless of turnover. If there are reasonable grounds to suspect an eligible data breach may have occurred, the organisation must carry out a reasonable and expeditious assessment, and take all reasonable steps to complete it within 30 days. If the assessment finds an eligible data breach, one likely to result in serious harm, the OAIC and the people affected must be notified.

Involve the practice's privacy adviser, insurer and incident-response provider early. Where a supplier is involved, agree quickly who is responsible for what, so assessment, containment and any required notification are not delayed. Kind also said: "Timely detection and response are critical to minimising the harm caused by data breaches."^[1]

Cyber incidents can also be reported to ASD through ReportCyber at cyber.gov.au/report, or by calling the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). This is general information only and isn't legal advice.

efex supports over 1,200 healthcare customers across Australia. A dedicated national healthcare service desk, with specialists in practice management, clinical imaging and dictation software, is backed by local teams in 25 locations and a 24x7 security operations centre.

We support and manage the vendor systems a practice relies on, so the practice has one accountable point of contact when something goes wrong. Our teams work across logins, devices, networks, backups and monitoring, with a focus on detecting issues early so the practice team can keep its attention on patient care.

If you would like to talk through any of the checks in this article, our security experts can help. You can also sign up to the Cyber Brief for regular updates on the threats affecting Australian organisations.

1. Office of the Australian Information Commissioner, Large-scale data breaches on the rise, latest OAIC statistics reveal (Notifiable Data Breaches, January to June 2026), 26 October 2026.
2. Australian Signals Directorate, Annual Cyber Threat Report 2025-26, October 2026 (pp. 14, 19, 25).
3. Australian Signals Directorate, Annual Cyber Threat Report 2024-25, In focus: the threat to the healthcare sector, October 2025.
4. newsGP, Medical information stolen in major cyberattack, 16 July 2026.
5. Cyber Daily, Australian patient data compromised in Icon Cancer Centre hack, 12 October 2026.
6. AJP, Icon falls victim to data breach, 13 October 2026.
7. The Canberra Times (AAP), Overseas hackers suspected in state health data breach, 4 November 2026.
8. ABC News, Police investigate cybersecurity breach of NSW Health's Oral Health Fee For Service Scheme website, 4 November 2026.
9. OAIC, Notifiable Data Breaches scheme.