Australian neurological diagnostic practice Hunter Neurology (hunterneurology.com.au) has been listed on the ransomware leak site operated by N0n, with the group claiming to have stolen thousands of patient records and four complete practice backups.
Hunter Neurology describes itself as a leading-edge neuro-diagnostic practice specialising in diagnostic testing for a range of neurological and neurophysiological disorders. Its services cover conditions affecting the brain, spine and nerves.
The N0n listing claims the allegedly stolen information includes substantial volumes of protected health information (PHI), making this a potentially significant incident involving sensitive patient data.
What data does N0n claim to have stolen?
According to the ransomware group’s listing, the alleged data includes:
| Data type | Claimed quantity |
|---|---|
| Patient images or scans | 15,252 |
| Patient letters or reports | 11,819 |
| Laboratory results | 439 |
| Other patient records | 839 |
| Complete practice backups | 4 |
The figures suggest the alleged compromise could extend beyond basic personal information to diagnostic images, clinical correspondence, test results and other medical records.
If the claims are accurate, the exposure could create significant privacy risks for affected patients. Medical information is particularly sensitive because it can reveal details about an individual’s health, diagnoses, investigations and treatment.
These figures are claims made by N0n and have not been independently verified. The ransomware listing alone does not establish the authenticity of the data, the circumstances of any compromise or whether the information has been accessed by other parties.
N0n: A rapidly emerging ransomware threat
N0n is a relatively new ransomware operation that has demonstrated broad targeting across multiple industries and countries.
Based on the available tracking data, N0n’s first recorded victim was listed on 18 September 2026. The group has subsequently listed 77 victims over a 30-day period, spanning 27 countries.
During its short operational life, N0n has targeted organisations across nearly all major business sectors. Technology and professional services combined account for approximately 46% of its reported targeting activity, indicating that its operations are not confined to a single industry.
The Hunter Neurology listing highlights the potential for healthcare organisations to be caught up in this broad targeting activity, where sensitive information can provide additional leverage for extortion.
The fourth Australasian healthcare entity recently listed
Hunter Neurology is the fourth Australasian healthcare entity to have appeared on ransomware leak sites in the recent wave of reported listings.
The growing number of healthcare-related listings reinforces the need for healthcare providers to prepare for cyber incidents involving both operational disruption and the exposure of sensitive patient information.
Healthcare organisations face particular challenges during ransomware incidents. Disruption to diagnostic services, access to patient records and clinical workflows can affect the delivery of care, while the exposure of medical information can create long-lasting privacy consequences.
Smaller specialist practices may also have fewer dedicated cybersecurity resources than large hospital networks, making fundamental security controls and effective incident response planning especially important.
What healthcare organisations should take away
The N0n listing is a reminder that ransomware resilience must extend beyond protecting production systems. Healthcare providers should ensure that:
- Backups are isolated and protected: Use offline or immutable backups where appropriate, restrict administrative access and monitor for unauthorised changes or deletion.
- Recovery is regularly tested: Validate that systems and patient data can be restored within acceptable timeframes, including following a compromise of privileged accounts.
- Sensitive data is protected: Apply least-privilege access, strong authentication, appropriate encryption and monitoring to clinical systems and data repositories.
- Data access is monitored: Investigate unusual bulk access, data staging, transfers and activity involving backup infrastructure.
- Incident response plans account for patient safety: Include procedures for maintaining clinical services, assessing privacy impacts and communicating with relevant stakeholders.
A developing story
At the time of writing, the information described above reflects claims published by N0n on its ransomware leak site. The listing should not, by itself, be treated as independent confirmation that the alleged data was stolen or that all four backups were successfully obtained.
Nevertheless, the claimed volume and sensitivity of the records make the listing one healthcare organisations should pay attention to. If substantiated, the alleged acquisition of complete practice backups would underline the importance of securing recovery infrastructure against the same threat actors targeting production environments.
For healthcare providers, the lesson is clear: ransomware defence must protect not only the systems used to deliver care, but also the patient information and recovery resources needed to keep those services operating.
