Australia: hacker sells patient documents from the country's largest cancer care group

Icon Oncology Group, which runs Australia's largest network of cancer centres, confirmed on 12 October that someone had gained unauthorised access to patient information. The data was not taken from Icon's own systems but from a supplier's. About two days before the announcement, a hacker going by "2019" put the documents up for sale on a popular hacking forum, according to Cyber Daily, which first reported the breach.

What the hacker is selling

The seller claims to hold more than 31,000 "sensitive and confidential documents" containing patient names, addresses, diagnoses and Medicare details. The data is offered as a "one-time offer in cryptocurrency" with no price listed. As proof, the hacker posted sample files that appear to come from Icon's supplier, including details of consulting and treating doctors and patient correspondence. The 31,000 figure and the list of data types come from the seller and have not been independently confirmed.

Icon has not named the supplier. The company says it has obtained a copy of the affected records and believes they "do not comprise complete patient files" but "discrete documents associated with correspondence" for its business. It is now working out which patients are in them and what information each document contains.

What Icon has done

According to its notice, Icon activated its incident response plan, reset access to the affected system, brought in cyber security and forensic advisers, and notified the Australian Federal Police and the relevant regulators. It says its own systems are secure and that patient care and treatment are not affected. For now the breach appears to involve Australian patients only, although the group also operates in Singapore, Malaysia, Indonesia, New Zealand, the UK and Germany. Icon says it will contact affected patients and their treating doctors directly.

Icon describes itself as the country's largest dedicated provider of cancer care, with more than 40 centres in every Australian state and territory. The group also owns Slade Health, which Cyber Daily calls Australia's largest chemotherapy compounder.

Who "2019" is

The seller's forum profile has been active since January 2026 and has about 45 posts, mostly about breaches and leaks, with a focus on Australian organisations. Earlier claimed victims include BestPriceTravel Australia, Court Services Victoria and the crisis support line Lifeline Australia.

Why medical data is worth more

A stolen password can be changed and a bank card can be reissued, but a cancer diagnosis cannot. Documents that link a name and home address to a diagnosis are useful for blackmail and for scams that sound convincing because they mention real details. In this case the documents were on sale before Icon made any announcement, and patients will hear from the company only after it has gone through them. Breaches at suppliers are a common pattern: last month Sweden fined an IT supplier whose leak exposed data on one in five people in the country.

If you have been treated at an Icon centre:

• Expect calls, texts and emails that mention your treatment, your doctor or Medicare. Icon says it will contact patients directly, so check any such message through the contact details on Icon's own website rather than the ones in the message.
• Do not pay anyone who threatens to publish your medical information, and report such messages to the police.
• Be careful with requests to "confirm" your Medicare number or bank details, even if the caller already knows your diagnosis.