Epichealth Medical Clinic, a privately owned network of four mixed-billing general practices in Victoria, Australia, has now confirmed what an intruder did inside its systems: moved through the internal network and walked off with patient data. Footprint is small: Warrnambool urgent care, Ocean Grove Marketplace, Ocean Plaza and Portarlington.
From leak site post to formal notice
The Gentlemen ransomware group listed Epichealth as a victim on October 31, claiming it held confidential data and threatening publication if its demands went unmet. Epichealth’s subsequent notice moves the incident from claim to confirmed event.
Stolen material runs from identity to clinical detail, with Medicare and Centrelink identifiers, dates of birth, names, emails, phones, home addresses, veteran card numbers and health information among it. Clinics stayed open, and the provider says it notified police, the Australian Cyber Security Centre and the Office of the Australian Information Commissioner.
Identity numbers raise the stakes
For Australian general practice, Medicare and Centrelink identifiers are the hardest data to reissue and the most useful to a fraud operation. That combination, sitting alongside clinical notes, makes the extortion leverage considerably stronger than a billing-data leak would be.
Why US security teams should log it
Epichealth is a small, four-site primary care group. An outside forensics firm confirmed the intrusion only after internal activity was spotted, and the gang’s claim arrived ahead of the public notice. US clinics running the same thin IT staffing should treat this as a template: detect on the network, engage outside help immediately, and pre-write both the law enforcement and patient notification steps. The Gentlemen remain an active extortion brand listing small healthcare operators, and the claim-to-notice sequence here belongs in vendor and incident-response tabletop material.
