Episode Details

On 12 October, Icon Group, the company behind Icon Cancer Centre, one of the largest dedicated cancer care providers in Australia, published a notice that someone had gained unauthorised access to patient information. Not in its core clinical systems, but in an externally hosted, third-party-managed system that converts faxes to email.

What Icon has confirmed: the unauthorised access, the type of system involved, that it believes the records are business correspondence documents rather than full patient files, that it has notified the Australian Federal Police and relevant regulators, that it has reset access and engaged forensic advisers, and that patient care continues.

What Icon has not confirmed: how many people are affected, exactly what data is involved, when the intrusion happened, or the name of the supplier.

What has been claimed, and is unverified: Cyber Daily reports that an actor calling itself "2019" posted a sale on a hacking forum claiming more than 31,000 documents with names, addresses, diagnoses and Medicare details. Icon has not confirmed those figures.

We walk through the timeline, why a fax gateway matters, what obligations apply under the Notifiable Data Breaches scheme, and what any organisation that sends health or financial documents by fax or email should ask its suppliers this week.

If you have been affected by a data breach, IDCARE offers free support in Australia and New Zealand.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: Icon Group notice (12 Oct, updated 15 Oct); Cyber Daily (original reporting; DataBreaches.net republished it); OAIC; IDCARE.