Why is this guide still relevant if the breach was in 2022?

Two reasons. First, the OAIC's enforcement action against Australian Clinical Labs concluded in 2025 with the Federal Court ordering a $5.8 million civil penalty - the first such penalty ever ordered under the Privacy Act 1988. The case set a precedent for regulator enforcement under the post-2022 reformed Privacy Act. Second, the Medlab dataset (including Medicare numbers and pathology details) continues to appear in identity-fraud kits being used today. The risk did not end in 2022 because medical identifiers cannot be rotated.

Should I cancel my Medicare card?

Generally not necessary as a precaution alone. Services Australia can issue a new Medicare number if you have evidence of misuse (for example, claims you did not make, or contact from health providers about services you did not receive). It is worth contacting Services Australia to discuss your circumstances if your Medicare number was confirmed to be in the exposed dataset.

What did the OAIC enforcement action find?

In 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million in civil penalties under the Privacy Act 1988 - the first civil penalty ever ordered under that Act. The penalty comprised $4.2 million for failing to take reasonable steps to protect personal information from unauthorised access, $800,000 for failing to carry out a reasonable assessment of whether the data breach was an eligible data breach under the Notifiable Data Breaches scheme, and $800,000 for failing to notify the OAIC of the eligible data breach as soon as practicable.

I had pathology with Medlab - is my actual diagnostic data exposed?

Yes - for a subset of affected patients, the exposed dataset included pathology test results and other clinical information, alongside the name of the referring provider. Pathology data is highly sensitive: it can include genetic information, infectious disease markers, hormone results, and other details that cannot be changed, revoked, or reissued. This makes ongoing vigilance especially important.

Was my credit card stolen?

Approximately 28,000 patients had limited credit card data included in the exposed records. Under PCI-DSS standards, merchants are not permitted to store the full Primary Account Number combined with the CVV/CVC, so the exposed data does not contain everything an attacker would need to clone a card. However, partial card data is still useful for fraud reconnaissance and targeted scams, so it is prudent to monitor card statements closely.

Australian Clinical Labs / Medlab Breach 2022:
What You Need to Know

Approximately 223,000 patient records were exfiltrated from Medlab Pathology, a subsidiary of Australian Clinical Labs, by the Quantum ransomware group in early 2022. The dataset included approximately 128,000 Medicare numbers, approximately 17,500 pathology test results and approximately 28,000 credit card records. In 2025 the Federal Court ordered ACL to pay $5.8 million in civil penalties - the first such penalty ever ordered under the Privacy Act 1988.

Breach detected:July 2022

Records affected:~223,000

Risk level:High

Your personal risk from this breach

View My Risk

What Happened

How the Medlab Breach Unfolded

February 2022

Attackers (subsequently identified as the Quantum ransomware group) gained initial access to Medlab Pathology, the pathology subsidiary acquired by Australian Clinical Labs (ACL) in 2021. Data was exfiltrated over the following weeks before any detection occurred.

March 2022

ACL detected unusual activity on Medlab's network and engaged external cybersecurity specialists. ACL's initial assessment concluded that no data had been removed from the environment, a conclusion the OAIC later alleged was unreasonable given the available evidence.

June - July 2022

The Quantum ransomware group published approximately 86 GB of stolen Medlab data to its dark web leak site. The Australian Cyber Security Centre (ACSC) notified Medlab of the dark web publication in June 2022, and on 10 July 2022 ACL formally notified the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.

27 October 2022

ACL publicly disclosed the breach via the ASX, confirming approximately 223,000 patient recordswere affected. The dataset included names, addresses, approximately 128,000 Medicare numbers, approximately 17,500 pathology test results and clinical information, and approximately 28,000 patients' partial credit card details.

The public disclosure came roughly three months after ACL had formally notified the OAIC and seven months after first detecting unusual activity.

December 2022

The OAIC opened a formal investigation into ACL's handling of the Medlab breach under the Privacy Act 1988 (Cth).

November 2023

The OAIC filed civil penalty proceedings against ACL in the Federal Court, alleging serious or repeated interferences with privacy under the Privacy Act 1988. This was the first such action pursued under the Notifiable Data Breaches scheme.

2025

The Federal Court ordered Australian Clinical Labs to pay a total of $5.8 million in civil penalties - the first civil penalty ever ordered under the Privacy Act 1988. The penalty comprised $4.2 million for failing to take reasonable steps to protect personal information, $800,000 for failing to carry out a reasonable assessment of whether the breach was an eligible data breach, and $800,000 for failing to notify the OAIC as soon as practicable.

This landmark ruling set the precedent for OAIC enforcement under the post-2022 reformed Privacy Act and signals a more assertive regulatory posture following the Optus and Medibank breaches.

Sources: MinterEllison (OAIC enforcement case analysis), OAIC: Notifiable Data Breaches

What Was Exposed

Personal Data Leaked in the Breach

The breach affected approximately 223,000 patients of Medlab Pathology, the subsidiary of Australian Clinical Labs that operated the compromised systems. The data exposed varies between patients: some had only basic contact information leaked, while others had Medicare numbers, pathology test results, and limited credit card data included in the dataset.

Data Type	Risk Level	Who Was Affected
Full name	High	All approximately 223,000 affected Medlab patients
Date of birth	High	All approximately 223,000 affected Medlab patients
Home address	High	All approximately 223,000 affected Medlab patients
Phone number	High	All approximately 223,000 affected Medlab patients
Email address	High	Subset of affected Medlab patients
Medicare number	High	Approximately 128,000 patients
Pathology test results / clinical information	High	Approximately 17,500 patients (pathology results, diagnoses, referring provider details)
Health insurance details	High	Subset of affected Medlab patients
Credit card data (limited)	High	Approximately 28,000 patients (partial card data; PCI-DSS standards mean full PAN+CVV were not stored)

Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Pathology results and clinical information are rated at the highest level due to their sensitivity and the impossibility of changing or revoking medical history.

Confirmed NOT Exposed

Based on public disclosures, full bank account details (BSB and account number combinations), full credit card numbers with CVV, and account passwords were not part of the leaked dataset. The physical pathology samples themselves are obviously not in scope of a data breach. Limited card data was included for a subset of patients, but PCI-DSS standards mean the full PAN combined with CVV is not stored by compliant merchants.

Company Response

What Australian Clinical Labs Did

“ACL has cooperated fully with the OAIC's investigation and continues to work closely with cyber security experts and authorities. The protection of patient information remains a priority for the business.”
Australian Clinical Labs, public statements on the Medlab breach

Actions Taken by Australian Clinical Labs

Engaged external cybersecurity specialists following detection of unusual activity in July 2022
Notified the Office of the Australian Information Commissioner (OAIC) after the data was published on the dark web in October 2022
Began contacting affected patients directly with details of their specific exposed data
Cooperated with the OAIC investigation and subsequent Federal Court enforcement proceedings
Reviewed and strengthened security controls across the combined ACL and Medlab environments following the incident

OAIC: Notifiable Data Breaches MinterEllison: Enforcement Case Analysis Australian Clinical Labs

What Now?

Steps You Can Take After the Medlab Breach

This breach is particularly sensitive because it included pathology test results and Medicare numbers for a subset of patients, alongside name date of birth home address and phone number for the broader group. Unlike a password, clinical data cannot be changed or reissued, so the risk from this breach is not time-limited. Here are general best-practice steps, organised by the types of accounts most commonly affected.

Health Provider Accounts

Your pathology provider account was exposed. Other health provider portals may use the same email.

Secure your ACL / Medlab patient account

~5 min

It is generally considered best practice to update the password on any Australian Clinical Labs or Medlab patient portal associated with exposed data. Enabling MFA where available adds a significant layer of protection. Consider reviewing recent activity for any unauthorised access or changes.

Go to Australian Clinical Labs

Review other pathology and health provider accounts

Where the same email address or password has been used across other pathology providers (Healius, Sonic Healthcare), GP patient portals, or My Health Record, consider updating credentials on those accounts as well. Credential reuse remains one of the most common ways a single breach leads to broader exposure across the health sector.

Email and Digital Identity

Your email is the key to your digital identity. Securing it is a sensible first step.

Strengthen email security

~5 min

Updating the password and enabling MFA on email accounts associated with the breach is widely recommended. It is also worth checking email forwarding rules and connected app permissions, as these can be exploited to silently intercept communications, including communications from your health providers.

Understand your full account exposure

Most people have dozens of online accounts linked to a single email address. When that email is exposed in a breach, understanding which services are connected is a critical first step in assessing personal risk. Tools that map your digital footprint can help identify accounts that may need attention.

Identity and Medicare Protection

Medicare numbers and clinical information carry long-term identity and privacy risks.

Consider a credit ban (especially if your Medicare number was exposed)

~20 min

For those whose Medicare number or date of birth was included in the exposed data, the risk of identity fraud is elevated. Placing a free credit ban with Australian credit bureaus prevents new credit from being opened in your name without additional verification.

Equifax AU Experian AU (formerly Illion)

Contact Services Australia about Medicare number misuse

~15 min

If a Medicare number was included in the breach, it is worth contacting Services Australia to discuss potential protections. A replacement Medicare card with a new number may be available where there is evidence of misuse or a heightened risk of identity fraud.

Services Australia: Medicare

Monitor card statements closely

For patients whose credit card data was included (approximately 28,000 records), reviewing card statements for unfamiliar transactions is a sensible precaution. Although PCI-DSS standards prevent storage of full PAN+CVV combinations, partial card data is still useful for fraud reconnaissance and targeted scams.

Recognise the ongoing nature of clinical data exposure

Unlike a password or credit card, exposed pathology results and clinical information cannot be changed, reissued, or revoked. This means the risk from this breach is not time-limited. It is prudent to remain alert to any unexpected contact that references medical history, pathology results, or specific referring providers, and to treat such contact with caution regardless of how legitimate it may appear.

Monitoring and Reporting

Australian resources for breach response and identity protection.

Contact IDCare for tailored guidance on sensitive health data exposure

IDCare (1800 595 160) is Australia's national identity and cyber support service and provides free, tailored guidance for people affected by data breaches. IDCare is particularly useful where sensitive health data has been exposed, as their case managers can help develop a personalised response plan covering Medicare, credit, and medical identity protection.

Stay alert for targeted phishing (including health-related scams)

Exposed name Medicare number and pathology results may be used to craft highly convincing phishing messages. Some phishing attempts may reference specific test results, referring GPs, or medical conditions to appear legitimate. Treat any unsolicited contact referencing Medlab, ACL, or specific pathology details with caution, and verify directly through official channels.

Report to Scamwatch or lodge a complaint with the OAIC

Reporting to Scamwatch contributes to broader awareness and helps authorities track emerging threats. Affected patients can also lodge a privacy complaint directly with the OAIC if they believe their personal information was mishandled.

Not sure which of your accounts are affected?

In The Event Of helps you find the accounts linked to your email and shows your breach exposure, so you can work through a clear, prioritised plan after an incident.

Check My Email Free

Are You Still at Risk?

The Hidden Danger: Compound Breach Exposure

The Medlab breach did not happen in isolation. If your data also appeared in other major Australian health-sector breaches, the combination of leaked information can build a deeply detailed medical and identity profile.

How breach data compounds

On its own, the Medlab breach exposed names, addresses, Medicare numbers, and pathology results for a subset of patients. But if your email also appeared in the Medibank, Genea, MediSecure, or Optus breaches, the combined dataset may include health claims, fertility records, electronic prescriptions, and identity documents. This kind of compound exposure across the health sector significantly increases the risk of identity fraud and targeted medical scams.

Medibank (2022)9.7M records - health claims, Medicare details
Genea (2025)940K records - fertility patient data
MediSecure (2025)12.9M records - electronic prescriptions
Optus (2022)9.8M records - passport, licence, Medicare numbers

If your email appears in two or more of these breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

Australian Clinical Labs / Medlab Breach FAQ

Sources

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

ACMI Data Breach 2026

~25,000 records exposed

Australian Clinical Labs / Medlab Breach 2022:What You Need to Know