When Clinical Systems Go Down, the Consequences Are Measured in Patient Outcomes

Healthcare is, by the data, Australia’s most breached sector. The OAIC’s Notifiable Data Breaches reporting has consistently placed health service providers at the top of its sector league table — accounting for 20% of all notifications in the second half of 2024, and 18% in the first half of 2025. This is not a statistical anomaly. It reflects a structural convergence of high-value data, operationally critical systems, constrained IT resources, and an attack surface that has expanded faster than most organisations’ ability to manage it.

Why this sector is targeted: Patient health data is among the most valuable categories of personal information on the criminal market. Unlike a compromised credit card number that can be cancelled, health records — encompassing diagnoses, medications, procedures, Medicare identifiers, and family history — are permanent. They support identity fraud at scale, insurance fraud, and targeted extortion. The MediSecure ransomware attack in April 2024 compromised approximately 12.9 million Australians’ prescription records, representing data on nearly half the country’s population. The breach forced the company into liquidation. In December 2023, St Vincent’s Health Australia — the country’s largest non-profit healthcare provider — experienced a cyberattack that resulted in data being removed from its network across hospitals and aged care facilities in multiple states. In early 2025, Victorian hospital group Epworth Healthcare was the subject of alleged data theft by the Global Group ransomware gang, with 40GB of data including patient records, medical imaging, and internal payroll information reportedly posted to the dark web. IVF provider Genea also suffered a ransomware intrusion in February 2025, with the Termite group claiming responsibility for exfiltrating nearly 940GB of patient records. These are not isolated events — they are the visible portion of a much larger pattern.

The structural vulnerabilities: ASD’s 2024–25 Annual Cyber Threat Report recorded that malicious actors succeeded in 95% of healthcare sector incidents the ACSC responded to — compared to 52% across all sectors. That figure is not primarily a reflection of poor intent on the part of healthcare organisations; it reflects the structural conditions under which they operate. Healthcare IT environments are characterised by a sprawl of legacy clinical systems, many running operating systems no longer receiving security updates. Medical devices — infusion pumps, patient monitors, imaging equipment, anaesthesia systems — are networked, often running embedded firmware that cannot be easily patched, and were designed for clinical performance rather than security. These Internet of Medical Things (IoMT) assets sit on the same underlying network infrastructure as administrative systems, creating lateral movement opportunities that skilled threat actors actively exploit. Add to this the ongoing digitisation of clinical workflows — electronic medical record (EMR) systems, telehealth platforms, digital imaging and pathology repositories — and the scope of the problem becomes clear. Each new system is a dependency. Each dependency is a potential failure point.

The operational stakes: The consequences of a clinical technology failure extend well beyond financial and reputational harm. When ransomware encrypts an EMR system, clinicians lose access to medication histories, allergy records, and diagnostic information at the point of care. Procedures must be postponed. Ambulances are diverted to other facilities, increasing pressure on the wider system. Staff revert to manual paper-based workflows, introducing both error risk and operational delay. Research published in academic literature has found that hospitals neighbouring a ransomware-attacked facility experience measurable spikes in emergency department presentations while the affected site deals with reduced capacity. In aged care environments, the stakes are equally serious: medication management, incident documentation, and care coordination systems all depend on network availability. A prolonged outage is not an inconvenience — it is a governance failure with direct implications for resident safety.

The distributed network reality: Most hospital networks, primary health networks, and aged care groups operate across multiple sites — a combination of metropolitan hospitals, community health centres, regional facilities, rural GP practices, and residential care sites, frequently connected through a mix of carrier-grade WAN, legacy MPLS, and in some cases, site-level broadband connections with variable quality and redundancy. The push toward centralised EMR platforms (such as Epic, Cerner, and local deployments) has increased the criticality of wide area network reliability: a degraded WAN connection is no longer just a productivity issue, it can directly impair clinical workflows. The rise of telehealth — accelerated substantially during the COVID-19 period and now a permanent fixture in outpatient and primary care models — has added further demands on bandwidth, latency, and uptime. In aged care, connectivity requirements have expanded to include resident-facing technology, staff communication platforms, and the monitoring systems underpinning clinical governance. Managing this environment consistently across dozens or hundreds of sites, often with small central IT teams, is one of the defining operational challenges for healthcare technology leaders.

Regulatory pressure and the governance gap: Healthcare is subject to a layered compliance environment that has grown significantly more demanding. The Security of Critical Infrastructure Act 2018 (SOCI Act) now designates critical hospitals — specifically those with general intensive care units — as critical infrastructure, imposing obligations on owners and operators regarding risk management programmes, incident reporting, and government access for purposes of national security. The My Health Records Act 2012 imposes specific obligations on healthcare providers connecting to the national digital health infrastructure, including mandatory security requirements for clinical information systems. The Privacy Act 1988 and the Notifiable Data Breaches scheme apply to all private health service providers regardless of annual turnover — a threshold that does not apply to other sectors. The Cyber Security Act 2024 introduced mandatory ransomware reporting obligations for organisations over $3M turnover. And the Australian Digital Health Agency continues to expand its security framework requirements for participants in the national digital health ecosystem. For many healthcare organisations — particularly private hospital operators, pathology groups, and aged care providers — building governance maturity fast enough to meet these obligations while simultaneously managing complex day-to-day operations is a genuine challenge. The regulatory frameworks are right to demand higher standards. The gap between where many organisations currently sit and what is now required is the territory where risk concentrates.