Patient records tied to Australia’s largest dedicated cancer care provider surfaced for sale on a hacking forum, prompting the operator to begin notifying those affected and to trace the exposure back to a third-party system.
Icon Oncology Group disclosed the incident on October 12, describing unauthorized access to some patient information held on a supplier’s system. In a notice posted to its website, the group said it moved at once after learning of the breach, putting its incident response plan into action, shutting off access to the compromised system to stop further intrusion, and calling in specialist cyber security and forensic advisers. The Australian Federal Police and relevant regulators were told as well.
Two days before that disclosure, the Icon Cancer Centre, whose headquarters sit in South Brisbane, had turned up in a for-sale listing on an underground hacking forum. A threat actor going by “2019” said the haul exceeded 31,000 “sensitive and confidential documents” and listed patient names, addresses, diagnoses and Medicare details among the contents, offering the lot in a one-time cryptocurrency sale. Files the poster attributed to the center’s supplier covered consulting physicians, treating doctors and patient correspondence.
Icon Oncology Group said it has obtained a copy of the affected records and is working to establish who was impacted. So far, the records look like discrete documents tied to business correspondence rather than full patient files. The group stressed its systems are secure and running normally, and that patient care and treatment are unaffected.
