Icon Cancer Centre, which operates cancer treatment services across Australia, New Zealand, United Kingdom and Southeast Asia, has been listed as a victim by the cyber threat group Group 2019, also known as Stuckin 2019. The group claims the incident involves more than 31,000 records containing patient demographic information and medical records.
The listing dated 10th October raises concerns about the exposure of sensitive healthcare information, particularly given the highly personal nature of the data associated with cancer diagnosis and treatment.
Icon Confirms Data Breach Involving Patient Information
On 12 October 2026, Icon Oncology Group published a statement confirming it was responding to a data breach involving unauthorised access to patient information held on a supplier’s system.
According to Icon, the incident currently appears to affect Australia only. The organisation says it activated its incident response plan, reset access to the affected system, and engaged specialist cybersecurity and forensic advisers. The Australian Federal Police and relevant regulators have also been notified.
Icon stated that it had obtained a copy of the impacted records and was working to identify the affected patients and determine exactly what information was involved. The organisation believes the records comprise discrete documents associated with business correspondence rather than complete patient files.
Icon also stated that its systems remain secure and operational, and that patient care and treatment have not been affected.
Affected patients and their treating doctors are to be contacted directly as the investigation progresses.
Source: Icon Oncology Group – Important notification: data breach incident.
Group 2019 Claims More Than 31,000 Records
The Group 2019 listing on a dark web forum claims the incident involves more than 31,000 records containing patient demographics and medical records.
These figures and the description of the data come from the threat actor. They have not been independently verified, and it remains unclear whether the claimed volume represents unique patients, individual documents, or a combination of records.
The group’s claims should therefore be treated with caution while Icon continues its investigation. However, the organisation’s public confirmation of unauthorised access to patient information establishes that a data breach incident has occurred, even though the full scope and nature of the affected information remain under assessment.
Previous New Zealand Victim: Sotheby’s International Realty
This is not the first time Group 2019 has been associated with an organisation in New Zealand. The group previously listed Sotheby’s International Realty in New Zealand, highlighting that its targeting is not limited to Australian organisations.
The Icon listing is particularly significant because healthcare information can carry substantial risks for affected individuals. Information relating to diagnoses, treatment, and personal circumstances can be exploited for targeted scams, identity fraud, or highly convincing social engineering.
The incident also illustrates the potential exposure created by third-party systems. Icon’s statement identifies a supplier’s system as the location where the affected patient information was held, reinforcing the importance of security controls extending beyond an organisation’s directly managed infrastructure.
Why This Matters for Australian and New Zealand Healthcare
Healthcare organisations continue to be a high profile target for ransomware operators gathering more media attention than other local victims.
Even when clinical systems remain operational, the unauthorised disclosure of patient information can create significant privacy, reputational, regulatory, and mental health risks to patients. Data breaches involving healthcare providers can also undermine patient confidence in the organisations entrusted with their care.
What Happens Next?
Icon says it is continuing to assess the affected records and will contact impacted patients and their treating doctors directly. Further information will be needed to establish the full scope of the incident and whether the threat actor’s claims accurately describe the exposed data.
For now, the Group 2019 listing should be treated as a threat actor claim, while Icon’s confirmation of unauthorised access provides the established basis for reporting the incident.
The case is another reminder that protecting healthcare information requires attention not only to clinical systems, but also to the suppliers and supporting services that process or store sensitive patient data.
