Blog › Data Breach

Lessons from the MediSecure Breach for Your Practice

In May 2024, MediSecure — a company that provided electronic prescription delivery services for Australian pharmacies and healthcare providers — suffered a ransomware attack. The breach exposed the personal and health information of approximately 12.9 million Australians, making it one of the largest data breaches in Australian history.

The data exposed included names, dates of birth, addresses, Medicare numbers, individual healthcare identifiers, concession card numbers, and prescription details. Shortly after, the stolen data was listed for sale on a dark web forum.

MediSecure was not a large hospital with hundreds of millions in annual revenue. It was a smaller healthcare technology organisation that, like many practices, held far more sensitive data than most people realised.

What happened?

The attack was a ransomware incident — attackers encrypted MediSecure's systems and then exfiltrated data before demanding a ransom. MediSecure entered voluntary administration shortly after the breach became public, meaning it was unable to respond effectively to the incident or support affected individuals.

The specific entry point that allowed the attackers in has not been publicly disclosed. However, the patterns common to this type of attack typically involve compromised credentials, unpatched vulnerabilities, or phishing — the same vectors that threaten every healthcare organisation.

Why this matters for your practice

Size doesn't provide protection

MediSecure wasn't a global corporation. It was a mid-sized technology provider in the Australian healthcare sector. Attackers don't filter targets by size — they look for organisations with valuable data and accessible vulnerabilities. A dental practice with 5,000 patient records and inadequate security controls is a target.

Healthcare data is uniquely valuable

The combination of information held by healthcare organisations — Medicare numbers, health conditions, prescriptions, personal identifiers — is worth significantly more to criminals than financial data alone. It can be used for identity theft, insurance fraud, and extortion. Once it's sold or published, you can't take it back.

Ransomware and data theft are now the same threat

Early ransomware attacks only encrypted files and demanded payment for the decryption key. Modern ransomware groups add a second layer: they exfiltrate data before encrypting, then threaten to publish it if the ransom isn't paid. This means even if you have good backups and can recover without paying, your patient data may still be leaked. The two threats must be addressed together.

Notifiable Data Breaches: Under the Privacy Act 1988 and the Notifiable Data Breaches (NDB) scheme, Australian health service providers are required to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. A ransomware attack that exposes patient records almost certainly meets this threshold. Non-compliance can result in significant penalties.

What the MediSecure breach reinforced

Backups alone aren't enough

If your only plan is to restore from a backup, you're only protected against the encryption half of a ransomware attack. The exfiltration of data — and the threat to publish it — isn't addressed by a backup. You need controls that detect and block exfiltration before it happens: endpoint protection, network monitoring, and data loss prevention policies.

Third-party risk is real

Many practices rely on third-party technology vendors — practice management software, billing platforms, prescription services, cloud storage providers. Each vendor that holds your patient data is an extension of your attack surface. It's worth asking your key vendors about their security practices, incident response plans, and data breach history.

Incident response planning matters

MediSecure's ability to respond to the incident was severely constrained by the scale of the breach and its financial position. Even for a smaller practice, having a written incident response plan — who to call, what to do in the first hour, how to notify patients and regulators — reduces chaos and limits damage when something goes wrong.

Steps to reduce your exposure

  • Enable MFA across all Microsoft 365 accounts — this prevents credential-based access even if passwords are stolen
  • Keep systems patched — unpatched vulnerabilities are one of the most common entry points for ransomware
  • Use modern endpoint protection — EDR tools that detect ransomware behaviour, not just known signatures
  • Segment your network — limit how far an attacker can move if they do get in
  • Test your backups — a backup you've never tested is a backup you can't rely on
  • Know your NDB obligations — understand when and how you need to notify the OAIC and affected patients
  • Review third-party access — know which vendors have access to your patient data and what their security posture looks like

What to do right now

You don't need to implement everything at once. The most impactful immediate actions are:

  1. Enable MFA for all staff accounts in Microsoft 365
  2. Ensure your backups are tested, offsite, and isolated from your main network
  3. Make sure your practice management software vendor notifies you of any security incidents
  4. Know your OAIC notification obligations before you're in a crisis

These four steps don't eliminate risk entirely — nothing does. But they close the gaps that attackers exploit most often, and they give you options if something does go wrong.

Understand your risk before an incident forces the conversation.

We assess your security posture — backups, MFA, endpoint protection, and more — as part of a free security audit for Australian dental and medical practices.

Book your free audit

More from the blog

Ransomware6 min read
Why Ransomware Targets Dental and Medical Practices
Read article →
Identity5 min read
What Is MFA and Why Every Clinic Needs It
Read article →
Phishing5 min read
How to Spot a Phishing Email Before It's Too Late
Read article →