Australian Clinical Labs Reports SunDoctors Data Breach Potentially Affecting 280,000 Individuals
Published
Key Takeaways
- External Breach: Australian Clinical Labs announced a cyber incident at an external IT service provider used by SunDoctors, resulting in unauthorized access.
- Broad Notification: The company is notifying around 280,000 people that their information may have been accessed.
- Limited Data: The affected data consisted mainly of basic contact details and some health information related to skin cancer checks and tests.
Australian Clinical Labs (ACL) said on Thursday that a cyber incident at an external IT service provider used by its SunDoctors unit resulted in unauthorized access to a limited portion of its systems, with some data exfiltrated. The pathology services provider announced the disruption was contained and did not affect its core operations.
Inside the SunDoctors Breach
SunDoctors' investigation found that most of the affected data consisted of basic contact details and some health information. “The vast majority of data involved includes basic contact information and some health information, mostly connected to skin cancer checks and related testing,” ACL said on June 18.
The probe could not identify which specific individuals were affected. As a precaution, SunDoctors decided to notify a broader group of around 280,000 people that their information may have been accessed.
The data breach occurred at an external IT provider used by SunDoctors, which the clinical testing group had first flagged on April 30, according to the healthcare provider announcement.
Core Operations Unaffected
ACL, which was last year ordered to pay penalties in relation to a 2022 Medlab Pathology data breach, said the incident was confined to part of SunDoctors' systems. Its broader pathology and laboratory operations were not impacted. The company stated there was no evidence that the information had been disclosed online.
In other recent news, hackers claimed to have breached Novo Nordisk, the maker of Wegovy and Ozempic, and medtech firm iRhythm Holdings disclosed a third-party data breach that occurred via social engineering.
Earlier this month, an Ultrahuman data breach was announced, in which hackers accessed wellness information via an internal analytics tool; in May, an NYC Health + Hospitals data breach exposed the sensitive biometrics of 1.8 million individuals.
Other cybersecurity incidents announced this year that reportedly occurred via third-party compromise include a Hims & Hers data breach, an Adidas data breach, an Inditex incident, and a Betterment email exposure.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular