What data was exposed in the Partnered Health breach?

Exposed information may include names, dates of birth, home addresses and contact details, along with Medicare numbers, private health insurance details, Veteran (DVA) card or concession card numbers, and medical information and treatment details such as consultation notes, referral letters, and pathology or diagnostic results recorded by a GP.

My Medicare number was exposed. What should I do?

If your Medicare number was included, you can contact Services Australia to discuss protections, including requesting a replacement Medicare card with a new number. A Medicare number combined with your name and date of birth can be used in identity-verification attempts, so it is sensible to stay alert for unexpected contact referencing Medicare or your health cover.

Can exposed medical records be changed or recalled?

No. Unlike a password or credit card number, medical information and treatment records cannot be reissued, changed or revoked once exposed. This means the risk from this kind of breach is not time-limited. It is prudent to remain alert to any unexpected contact that references your medical history and to treat such contact with caution, regardless of how legitimate it appears.

What has Partnered Health done in response?

Partnered Health reported the incident to the Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC) and law enforcement. It also sought an interim injunction from the Supreme Court of NSW ordering that the accessed data not be used or published, engaged cybersecurity specialists, and notified affected patients by SMS.

Why did notification take 22 days?

Partnered Health became aware of the unauthorised access on 23 June 2026 and notified patients on 15 July 2026. Organisations often need time to investigate which individuals and data were affected before they can notify accurately. Under Australia's Notifiable Data Breaches scheme, entities must assess a suspected eligible breach expeditiously and notify affected individuals and the OAIC once an eligible breach is confirmed.

Partnered Health Data Breach 2026:
What You Need to Know

Q: How do I know if I was affected by the Partnered Health breach?

Partnered Health notified affected patients directly by SMS on 15 July 2026. If you are a patient at one of the affected clinics and received an SMS from Partnered Health, your information may have been exposed. Twenty-one general practices across NSW, Victoria, Queensland, Western Australia and the ACT were caught up in the breach. If you are unsure, contact your clinic or Partnered Health directly using the details on their official website, and check your email against known breaches using the free In The Event Of breach checker.

Partnered Health, one of Australia's largest general-practice networks, was breached in June 2026, exposing patient data across 21 clinics. The stolen information reportedly includes Medicare numbers, health insurance details and sensitive medical records. Here is what happened, what was exposed, and the steps you can take to protect yourself.

Aware:23 June 2026

Clinics affected:21 (16 directly)

Risk level:High

Your personal risk from this breach

View My Risk

What Happened

How the Partnered Health Breach Unfolded

23 June 2026

Partnered Health became aware that a malicious actor had accessed some of its data. The company later engaged cybersecurity specialists and began investigating the scope of the incident.

Late June to July 2026

Partnered Health reported the incident to the Australian Cyber Security Centre (ACSC), the Office of the Australian Information Commissioner (OAIC) and law enforcement, and sought an interim injunction from the Supreme Court of NSW ordering that the accessed data not be used or published.

15 July 2026

Partnered Health notified patients by SMS that their information may have been exposed. The breach was disclosed publicly the same day, roughly 22 days after the company first became aware of the unauthorised access.

Twenty-one general practices across NSW, Victoria, Queensland, Western Australia and the ACT were caught up in the breach, with patients at 16 clinics reported as directly affected. The incident came days after UK healthcare group Bupa announced a $450 million acquisition of Partnered Health.

Source: SMBtech and Partnered Health

What Was Exposed

Personal and Health Data Exposed in the Breach

Partnered Health said the stolen information may include the categories below. Because this is a healthcare breach, much of the exposed data is sensitive informationunder Australia's Privacy Act, which carries stronger protections and a higher long-term risk than ordinary contact data.

Data Type	Risk Level	Who Was Affected
Full name	High	Patients of affected Partnered Health clinics
Date of birth	High	Patients of affected Partnered Health clinics
Home address and contact details	High	Patients of affected Partnered Health clinics
Medicare number	High	Patients whose Medicare details were on file
Private health insurance details	High	Patients with private health cover recorded
Veteran (DVA) or concession card numbers	High	DVA and concession-card holders
Medical information and treatment records (consultation notes, referral letters, pathology and diagnostic results)	High	Patients whose records were held in the affected systems

Risk levels based on the OAIC: What is personal information? guidance. Health information, Medicare numbers and treatment records are rated High because they are sensitive information under the Privacy Act 1988: they cannot be reissued once exposed, can be used to craft highly convincing health-themed scams, and (with name and date of birth) are commonly used to verify identity with government and health services.

Why health data is different

You can change a password or cancel a credit card. You cannot change your medical history, and a Medicare number is slow and inconvenient to replace. That makes a health-records breach a long-lived risk rather than a one-off event, so the protective steps below focus on ongoing vigilance as much as immediate action.

Company Response

What Partnered Health Did

“We became aware that a malicious actor accessed some of our data. We take the security and privacy of patient information very seriously.”
Partnered Health statement (as reported)

Actions Taken by Partnered Health

Engaged cybersecurity specialists to investigate the incident
Reported the breach to the Australian Cyber Security Centre (ACSC), the OAIC and law enforcement
Sought an interim injunction from the Supreme Court of NSW to stop the accessed data being used or published
Notified affected patients by SMS on 15 July 2026

Partnered Health Notice OAIC Data Breaches

What Now?

Steps You Can Take After the Partnered Health Breach

The exposed combination of name date of birth Medicare number and health records is a strong identity-fraud and scam ingredient. Here are general best-practice steps, organised by the areas most relevant to this breach.

Health and Medicare

Your Medicare and health-cover details were reportedly exposed. These carry long-term identity and privacy risks.

Contact Services Australia about your Medicare number

~15 min

If your Medicare number was included, it is worth contacting Services Australia to discuss protections. A replacement Medicare card with a new number can be issued where there is a risk of misuse.

Services Australia: Medicare

Review private health insurance and concession accounts

If your private health insurance, Veteran (DVA) card or concession card details were exposed, review those accounts for unexpected activity and contact the relevant provider if anything looks wrong. Be cautious of any contact asking you to 'confirm' these details.

Email and Digital Identity

Your email is the key to your digital identity. Securing it is a sensible first step.

Strengthen email security

~5 min

Updating the password and enabling multi-factor authentication (MFA) on the email account tied to your health services is widely recommended. It is also worth checking email forwarding rules and connected-app permissions, which can be abused to silently intercept messages.

Understand your full account exposure

Most people have dozens of online accounts linked to one email address. When that email is exposed alongside health data, mapping which services are connected is a critical first step in assessing your personal risk.

Identity Protection

Name, date of birth and a Medicare number together are commonly used in identity verification.

Consider a credit ban (especially with Medicare and date of birth exposed)

~20 min

Because date of birth and a Medicare number were reportedly exposed alongside your name, the combination could be used in attempts to open credit or services in your name. Placing a free credit ban with Australian credit bureaus prevents new credit from being opened without additional verification.

Equifax AU Experian AU

Stay alert for targeted, health-themed phishing

Exposed health records and Medicare number can be used to craft convincing scams that reference real appointments, referrals or results. Do not click links in unexpected messages, and verify any contact by calling your clinic or Partnered Health directly using details from their official website.

Monitoring and Reporting

Australian resources for breach response and identity protection.

Contact IDCare or report to Scamwatch

IDCare (1800 595 160) is Australia's national identity and cyber support service and provides free, tailored guidance for people affected by data breaches. Reporting to Scamwatch helps authorities track emerging threats.

Check your exposure across breaches

Reviewing which of your accounts share the exposed email is a practical way to prioritise what to secure first, especially if your data also appeared in other recent Australian health breaches.

Not sure which of your accounts are affected?

In The Event Of helps you find the accounts linked to your email and shows your breach exposure, so you can work through a clear, prioritised plan after an incident.

Check My Email Free

Are You Still at Risk?

The Hidden Danger: Compound Breach Exposure

The Partnered Health breach did not happen in isolation. If your data also appeared in other major Australian health breaches, the combination of leaked information can build a far more complete medical and identity profile.

How breach data compounds

On its own, the Partnered Health breach exposed Medicare numbers, health-cover details and medical records. But if your email also appeared in the Medibank, Genea or Australian Clinical Labs breaches, the combined data set may include health claims, pathology results and further Medicare details. This kind of compound exposure significantly increases the risk of identity fraud and health-themed scams.

Medibank (2022)9.7M records - health claims, Medicare details
Genea Fertility (2025)~940K records - IVF and medical records
Australian Clinical Labs (2022)~223K records - pathology results, Medicare numbers
Partnered Health (2026)Medicare, health insurance, medical and treatment records

If your email appears in two or more of these breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

Partnered Health Breach FAQ

Sources

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

ACMI Data Breach 2026

~25,000 records exposed

Partnered Health Data Breach 2026:What You Need to Know