Brisbane clinic delayed patient breach alert by 3 months after phishing attack

In April, hackers broke into the email system at GO2 Health, a medical clinic in Brisbane's northern suburb of Everton Park. The breach came through a phishing attack—a common tactic where criminals trick employees into revealing credentials. The clinic discovered the intrusion on April 24 and immediately brought in security experts to contain the damage. But the patients whose information had been exposed didn't learn about it until July 16, nearly three months later.

The mailbox that was compromised contained sensitive material: Department of Veterans Affairs identification numbers, personal health information, and details from patient communications spanning the previous year. The clinic emphasized that the breach was limited to email—the main patient database remained secure. Still, the exposure was real and substantial. GO2 Health, which provides general practice and veteran care services, alerted the Office of the Australian Information Commissioner on May 18, meeting the regulatory requirement to notify authorities within 30 days of discovering a breach likely to cause serious harm. But the patients themselves waited nearly two more months.

The clinic's explanation for the delay centered on accuracy. A spokesperson said the investigation took time to identify exactly which patients had been affected, and the clinic wanted to avoid sending alerts to the wrong people or providing incomplete information. "We wanted to avoid causing undue concern and confusion by notifying the wrong people, or communicating inaccurate information," they said. It's a reasonable-sounding argument, but it left actual patients in the dark for a quarter of a year.

Amanda, a veteran receiving psychological treatment, was among those who eventually received the notification. She understood the clinic's desire to get the details right, but she saw the delay differently. Three months, she said, represented lost opportunity—time her and other patients could have spent changing passwords, monitoring accounts, and taking protective steps. "I think they've wasted really precious time for people to check their accounts and change their passwords," she said. For someone whose sensitive mental health information had been sitting in an exposed mailbox, the window to act had simply closed.

The breach at GO2 Health is the second major incident to hit Australian medical clinics in a matter of days. Partnered Health, a larger operator with nearly 60 clinics, had 16 of them compromised in June and notified patients after 22 days. Cybersecurity experts are now pushing for stricter rules that would require medical clinics to alert patients much earlier in the investigation process, rather than waiting until every detail is confirmed. The argument is straightforward: health information is uniquely sensitive, and the people whose data is at risk deserve to know sooner rather than later.

Amanda has already applied to change her Medicare number and tried to contact GO2 Health to ask whether she should update her Department of Veterans Affairs card as well. She hasn't received a response. Going forward, she said she would continue seeking treatment but with new caution. "I'm still going to be needing to receive treatments, but I think I'm going to be more cautious and ask more questions around how my data is stored." The breach has left her, and others like her, with a harder question to answer: how much do you trust an institution with your most private information when it takes them three months to tell you it's been compromised?