Les Bell

A "cyber attack" - likely a ransomware attack - has paralysed a Western Sydney radiology clinic, leaving patients with cancelled appointments and no access to results of scans and tests.

Channel 9 News reports that Quantum Radiology, which as 10 practices across Western Sydney and the Central Coast, failed to notify patients, simply cancelling appointments without explanation and closing practices with a posted notice attributing the closure to an "unforeseen IT issue". The firm has called in police and the Australian Cyber Security Centre as it grapples with the issue, which has seen their practices closed for over a week now.

This is a textbook example of how not to deal with a ransomware attack - we know from previous cases that organizations which are open and proactive in notifying stakeholders recover well after such attacks. Affected customers will tend to take a more sympathetic view in such cases, correctly identifying the ransomware gangs as the villains. But keeping customers in the dark - especially when many are doubtless anxious about their health - is now resulting in angry patients appearing on TV; never a good look.

Meanwhile news has leaked of an earlier attack on a Brisbane chain of general practices, Top Health Doctors, which suffered a breach back in September. The breach affected approximately 5,500 patients, but the chain apparently notified them reasonably promptly, containing subsequent publicity. The breach has only come to public attention via the gazetting of a data matching program by Services Australia to identify any subsequent breaches which made use of a patient's Medicare number or Centrelink Reference Number.

I think we can now put to rest any notion that ransomware gangs will give personal health information a wide berth.

Services Australia, NOTICE OF A DATA MATCHING PROGRAM – SERVICES AUSTRALIA AND TOP HEALTH DOCTORS CUSTOMERS AFFECTED BY SEPTEMBER 2023 DATA BREACH, Australian Government Federal Register of Legislation, November 2023. Available online at https://www.legislation.gov.au/Details/C2023G01220.

Theocharous, Mikala, Patients in the dark after cyberattack forces closure of radiology clinic, 9 News, 30 November 2023. Available online at https://www.9news.com.au/national/quantum-radiology-hit-by-cyberattack-patients-in-the-dark/81428039-3254-45d2-94b3-872cb85e3164. Related video at https://www.youtube.com/watch?embed=no&v=-jmaWBKd27Y.

Upcoming Courses

• SE221 CISSP Fast Track Review, Sydney, 11 - 15 March 2024
• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 May 2024
• SE221 CISSP Fast Track Review, Virtual/Online, 17 - 21 June 2024
• SE221 CISSP Fast Track Review, Sydney, 22 - 26 July 2024

About this Blog

I produce this blog while updating the course notes for various courses. Links within a story mostly lead to further details in those course notes, and will only be accessible if you are enrolled in the corresponding course. This is a shallow ploy to encourage ongoing study by our students. However, each item ends with a link to the original source.

These blog posts are collected at https://www.lesbell.com.au/blog/index.php?user=3. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.