Cyberattack disrupts hospital network and puts patient data at risk

A cyberattack that has disrupted a major hospital network is forcing clinicians to rely on manual processes while investigators assess whether sensitive information was stolen. Reports of delayed appointments, unavailable test results and diverted emergency arrivals show how quickly a technical incident can become a patient-care problem. For many Australians, this is the clearest sign yet of the risks carried by connected medical systems.

The danger extends beyond inaccessible records. Hospitals hold identity, diagnostic and billing data, while ransomware and other criminal campaigns may steal information before systems are encrypted. A ransom demand or service outage does not prove that every record was exposed, but it raises the possibility of a data breach affecting patients, staff and contractors. Clear advice from health authorities is therefore essential while forensic and regulatory work continues.

Scale of disruption reaches beyond hospital doors

Clinical care does not stop when a hospital’s network fails. Electronic health records, pathology systems, imaging archives, pharmacy platforms and bed-management tools often feed into one another, so a single compromised system can affect several departments. Clinicians may need to recreate medication histories, refer patients for repeat tests or follow handwritten downtime procedures until normal access returns.

The effects can spread across the wider community. Ambulance services may divert patients to another hospital, elective procedures may be postponed and GP clinics may lose access to shared diagnostic services. A GP may also be unable to send a referral or discharge summary, making it harder to coordinate care after a patient leaves hospital.

This scale matters in Australia, where large public hospital networks operate in Sydney, Melbourne, Brisbane, Adelaide and Perth while smaller rural services rely on metropolitan pathology, telehealth and specialist support. A disturbance at a shared laboratory or digital platform can therefore affect patients far from the hospital that first reported the disruption.

Patient records carry risks beyond inconvenience

The information at risk may include names, dates of birth, addresses, contact details, Medicare numbers and insurance information. It can also include diagnoses, medication records, pathology results and appointment histories. Combining administrative and clinical data gives identity thieves a much clearer picture of a person and makes convincing scams easier to create.

Attackers commonly use data exfiltration, a term for stealing information while remaining inside a network, before deploying ransomware to restrict access. Hospitals are attractive targets because they cannot shut down for days without affecting urgent treatment. A criminal may threaten to publish stolen data unless payment is made, even when the affected organisation refuses to negotiate.

Australia’s My Health Records system adds another layer to consider. Pathology results are generally uploaded unless a person has opted out, and patients can control which healthcare providers can access their records. Recent federal privacy reforms have strengthened protections around the use of health information, including restrictions on targeted advertising. They have not removed the underlying need for strong cybersecurity at hospitals, pathology laboratories and medical technology suppliers.

Health systems present a difficult target

Healthcare technology must remain available around the clock, including during maintenance windows and public holidays. Hospitals also operate a mix of newer digital platforms and long-established clinical systems, creating compatibility and security challenges. A routine software update cannot always be installed immediately if the change might interfere with critical care.

Third-party access is another significant concern. Service providers may connect to hospital networks to maintain medical devices, process claims, host software or support remote diagnostics. If one supplier account is compromised, attackers may gain a route into several organisations. This supply-chain risk is particularly relevant to pathology, radiology, pharmacy and telehealth companies serving multiple hospital networks.

These technical problems can become patient-safety issues when clinicians cannot quickly check allergies, medication interactions or recent test results. Manual records can help during an outage, but they may not contain the same information as a connected system. That is why cyber resilience, tested backups, multifactor authentication and rehearsed downtime procedures are treated as essential parts of clinical safety rather than optional information technology work.

Australian law and security frameworks shape the response

The legal response depends on the organisations involved. Private health service providers are generally covered by the federal Privacy Act 1988 and the Australian Privacy Principles when they meet the Act’s thresholds. Public hospitals and clinics may operate under state and territory privacy legislation, including the Health Records Act 2001 in Victoria and the Privacy and Personal Information Protection Act 1998 in New South Wales. The Notifiable Data Breaches scheme can require organisations to assess eligible privacy breaches and notify affected people and regulators.

The Australian Signals Directorate, through the Australian Cyber Security Centre, supports incident response and publishes guidance on ransomware, backups and compromised accounts. The ASD Essential Eight framework provides a practical baseline for improving information security, while the Cyber Security Act 2018 and related arrangements can apply to government systems and infrastructure of national significance. Public health agencies also work with state computer emergency response teams.

Patients should expect transparent communication about what is known. A useful update identifies the affected services, explains whether records were encrypted or stolen, describes any risks to affected individuals and provides a reliable contact for support. Notifications should avoid claiming that data is safe merely because no misuse has been detected, while also not alarming patients before investigators understand the scale of the incident.

Protect patients and strengthen health services

Patients affected by the disruption should use only verified information from the hospital, local health service or state health department. Avoid links in unexpected messages about test results, refunds or medical records, and never provide a password or one-time security code to confirm an appointment. People who receive suspicious calls claiming to represent a hospital or laboratory should contact the organisation through its official phone number. Anyone needing urgent medical attention should call 000 or attend an emergency department rather than wait for systems to be restored.

Digital account security is equally important. Patients can strengthen access to My Health Records and related services with a unique password, multifactor authentication or a passkey where supported. They should also check privacy settings, review unfamiliar access and remove old authorised providers when appropriate. Australians concerned about how their digital health information is managed can use the My Health Records website to check their status and exercise their privacy choices.

Health organisations should act now to contain the incident, preserve evidence and prevent the compromised access from spreading. Essential measures include isolating affected devices, rotating credentials, reviewing vendor access, maintaining offline backups and testing whether patient identification, medication and diagnostic workflows can continue without the network. Cyber incident plans should include clear routes for clinical leaders, technical teams, regulators, law enforcement and patient communication to work together.

Follow official updates from the affected health service, enable stronger account protection, and share verified advice with family members who may need to arrange appointments or medication. Every informed patient, engaged clinician and prepared organisation can reduce the damage when hospital systems come under attack.