St Andrew’s Hospital in Adelaide, South Australia, has confirmed a cyber security incident in which an unauthorised third party accessed its servers and downloaded files containing patients’ personal information. The incident has prompted patient notifications, a forensic investigation and involvement from Australian cyber security and privacy authorities.
Patient Information Downloaded from Hospital Servers
On 8 October 2026, St Andrew’s Hospital confirmed that its investigation had identified a subset of data downloaded from its servers. While the hospital has not publicly disclosed the number of affected individuals, it has begun contacting those whose information may have been compromised.
According to reporting by 7NEWS, the information downloaded included:
- Full names and dates of birth
- Residential addresses and phone numbers
- Email addresses
- Medicare card numbers
- Healthcare identifiers
The exposure of these details creates potential risks beyond ordinary data theft. Criminals could use the information to support identity theft, impersonation, targeted phishing campaigns or attempts to commit health-related fraud. Combining personal contact details with Medicare information may also make fraudulent communications appear more credible.
The full extent of the breach, including whether additional categories of information were affected, has not been publicly established. The hospital has also not disclosed the precise number of people impacted or the technical method used to gain access.
Hospital Takes Systems Offline and Launches Investigation
St Andrew’s Hospital said it took its systems offline as a precaution after identifying the incident, worked to secure its environment and strengthen security protocols, and engaged specialist forensic experts to investigate.
The hospitals main public website is unavailable outside of Australia.
The hospital has notified the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC). It is also working with government agencies to introduce additional protective measures intended to detect and prevent suspicious or fraudulent activity.
Chief executive Angela McCabe said the investigation had progressed to the point where the hospital could communicate directly with affected individuals. The hospital is providing those individuals with information and support to help protect their personal information and has apologised for the concern caused by the incident.
Government Seeks Answers
South Australian Premier Peter Malinauskas said the state government expected to be briefed on the incident and wanted authorities to establish whether criminal offences under South Australian law had occurred.
Although St Andrew’s is a private hospital, the incident has drawn attention to the wider cyber security challenges facing healthcare providers and other organisations holding sensitive personal information.
The hospital’s notification obligations also fall within Australia’s federal privacy framework. Under the Notifiable Data Breaches scheme, covered organisations must notify the OAIC and affected individuals when a breach is likely to result in serious harm.
The Wider Cyber Security Implications
This incident highlights the risks healthcare organisations face when unauthorised parties gain access to systems holding patient information. Data such as dates of birth, addresses and healthcare identifiers can remain useful to criminals long after an incident has been contained, enabling follow-on fraud and highly targeted social engineering.
For healthcare providers, effective protection requires more than preventing ransomware or maintaining system availability. Organisations also need to limit unauthorised access to sensitive records, monitor for suspicious data access and transfers, maintain effective incident response procedures, and ensure that compromised information can be identified quickly.
The St Andrew’s Hospital investigation remains ongoing. Hunting on the dark web fails to show the number of affected individuals, the initial access method and whether the stolen information has been published or misused have not been confirmed in the reporting available as of 12 October 2026.
