Epichealth cyber incident: unauthorised third party accessed IT systems at Victorian medical clinics
Severity: medium · Patch status: no-fix-needed · Since 2026-11-09
Epichealth, which operates four medical clinics in Victoria, Australia — the Warrnambool Medicare Urgent Care Clinic, Epichealth Ocean Grove Marketplace, Epichealth Ocean Plaza, and Epichealth Portarlington — disclosed a cyber incident in which an unauthorised third party accessed part of its IT systems. The organisation became aware of the access and issued an update on 4 November 2026. Details on the volume or nature of patient data accessed, the attack vector, and any extortion have not been stated in the available source. As a healthcare provider handling Medicare and clinical records, potential exposure of patient information is the main concern. No fix applies; the incident is under investigation and further updates are expected.
What to do
- Patients of the four Epichealth clinics should monitor for phishing or identity misuse and watch for notifications about affected data
- Epichealth patients should be cautious of follow-up scam communications referencing the incident
- Organisations should review healthcare-sector breach notifications for indicators relevant to their own suppliers
- Ensure any data shared with Epichealth is covered by breach-notification and privacy obligations
Sources
All live incidents on Threat Watch
