Partnered Health disclosed on 15 July 2026 that a hacker accessed its data on 23 June 2026, compromising 21 clinics across Sydney, Melbourne, and Canberra The Guardian. The breach affected clinics within Partnered Health's Primary Care Group, which runs more than 50 general practices and skin cancer clinics across Australia 7 News Melbourne. Specialist cyber experts were brought in to respond Partnered Health.

The stolen data falls into two categories. Personal information includes Medicare numbers, private health insurance details, names, dates of birth, and addresses The Guardian. Medical information believed stolen includes treatment details, consultation notes, referral letters, and test results The Guardian.

Partnered Health obtained an interim injunction from the New South Wales supreme court. That is a temporary court order telling anyone who has the data not to use it or share it The Guardian. Patients and stakeholders affected by the breach have been contacted. A Partnered Health spokesperson declined to say publicly how many people were affected The Guardian.

Cybersecurity experts have questioned why Partnered Health took more than three weeks to reveal the breach, which happened on 23 June 2026 but was not disclosed until 15 July 2026 ABC News. The delay is likely to attract attention from regulators and lawmakers, especially because the stolen data is highly sensitive and Australia's Notifiable Data Breaches scheme requires organisations to notify affected individuals and the government when a breach could cause harm.

Dr Suelette Dreyfus, a senior lecturer at the University of Melbourne, warned that the stolen medical data could be sold on the dark web despite the court injunction The Guardian. The dark web is a hidden part of the internet where illegal activity, including the sale of stolen data, often takes place. Personal medical information reportedly sells for up to US$250 per record there. Basic personal details like a name and address sell for just a few cents each The Guardian.

The reason medical records are worth so much more is that they contain specific details about a person's health. Criminals can use them to trick people into giving up more information, commit insurance fraud, or even blackmail someone. A court order can stop people from publishing the data in places where Australian law applies, but it cannot stop someone on the dark web or outside Australia from selling it.

Partnered Health operates more than 50 GP and skin cancer clinics nationally 7 News Melbourne. Its Primary Care Group runs general practices and skin cancer clinics. The organisation also operates TeleWell, a 24/7 telehealth platform, Fuel Your Life, described as Australia's largest dietitian provider, Northcare Physio, described as South Australia's largest physiotherapy network, and a Corporate Health & Wellbeing Group that includes Jobfit, Baseline Onsite, New View Psychology, NewPsych Psychology, and Australian EAP Partnered Health. Jobfit delivers occupational health services. New View Psychology, NewPsych Psychology, and Australian EAP together are described as Australia's largest provider of psychological and employee assistance services Partnered Health.

The available facts do not show which of these business units, beyond the 21 affected clinics, had data accessed. The full scope of the breach across Partnered Health's systems is not yet detailed. A Partnered Health spokesperson declined to publicly disclose the number of people affected The Guardian.

The broader context here is that criminals are increasingly targeting healthcare providers because medical data is both valuable and deeply personal. When identity information and medical records are stolen together, the risk doubles. Someone could steal a person's identity and also expose private health information that patients expect to stay confidential. Because Medicare numbers and private health insurance details were included, the fraud risk extends beyond the clinics themselves and could affect government programs and private insurers.

The more than three-week delay between the 23 June 2026 attack and the 15 July 2026 disclosure raises questions about how quickly the organisation responded and whether affected people had enough time to protect themselves. The court injunction is a step toward containing the damage, but as Dr Dreyfus cautioned, it cannot directly stop the sale of stolen records on hidden online markets outside the court's reach The Guardian.