A large health care chain that owns family medical clinics across Australia has been the victim of a cyber breach which has exposed the data of their patients, including potentially treatment information.

Partnered Health runs a large number of clinics across Australia, with sixteen of them listed as directly affected, and a further group yet to confirm the status of their networks and systems.

The company says: “On 23 June 2026, Partnered Health became aware that a malicious actor accessed some of our data. In response, Partnered Health engaged specialist cyber experts to provide advice. We took immediate steps to contain the incident and assess whether personal information was accessed. This investigation remains ongoing.”

It’s taken 22 days for the company to report the breach to customers and authorities, with patients today receiving SMS notifications of the breach.

The worst affected clinics are:

  • Blackburn Road Medical Centre
  • Broadway General Practice
  • Bundall Medical Centre
  • Cardiff Medical Centre & Skin Cancer Clinic
  • Castle Hill Family Doctors
  • Chancellor Park Family Medical Practice
  • Dural Medical Centre
  • Mornington Family Doctors
  • Noosaville Seven Day Medical Centre
  • North Canberra Family Practice
  • Park Beach Family Practice
  • Park Orchards Family Practice
  • Sans Souci Medical Practice
  • Templestowe District Medical Centre
  • Wentworth Avenue Family Practice
  • Wyong Family Practice

The remaining clinics have been cleared, except for the following five which are still under investigation:

  • Champion Drive Medical Centre
  • Dromana Family Doctors
  • Joondalup City Medical Group
  • Kealba Family Practice
  • Rockingham City Family Practice

For patients treated at the worst affected clinics, the following information may now be in the hands of the hackers.

In its notification, Partnered Health says this may include:

  • name, date of birth, address and contact details;
  • Medicare card number;
  • where applicable, your private health insurance, Veteran Card (DVA) number, or concession card number; and
  • your medical information and treatment details, including consultation notes, referral letters, and pathology or diagnostic results recorded by your GP or other medical professionals you have visited at the clinic.

They go on to say there is “no direct evidence that patient records have been viewed”, but that will be of little comfort to affected patients.

The Risk

Fraud, scams and blackmail.

Scammers will use this new information about you (always assume scammers already know a bit about you) to build a better profile of you, in the hope of tricking you via a future SMS, email or phone scam.

Additionally, with that most personal of information about your treatment, scammers may look to extort money from you in return for not publishing or sharing your most intimate details.

For people who have had referrals to other doctors or clinics, this could feel overwhelming and devastating.

What should patients of Partnered Health do?

Vigilance, sadly, is the only answer here.

You can’t get the information back. You can’t stop whatever information they have about you from being shared with malicious intent on the dark web.

But you can resist any advances from scammers. Treat with caution any contact you have about your health care. Verify any callers or senders by ending any contact (don’t continue a conversation, don’t click any links) and begin your own contact with your doctor using your own existing contact information for them.

Additionally, keep abreast of any updates to the information released by Partnered Health to ensure you know exactly what you’re dealing with.