2026 Partnered Health — Incransom claim; ~3.2TB / 17,727+ patient files (unverified scale)
Data compromised
Actor-claimed: ~3.2TB / 2,298,203 files from 21 clinic servers; 17,727+ named patient files; staff HR (passports, AHPRA, tax); SQL medical/payroll DBs; data spanning 1999–2026 (27 years) — scale/inventory unverified; company has confirmed PHI theft from 21 clinics without publishing these counts
Technical writeup
Unverified leak-site / extortion claim — discovered July 30, 2026 on Ransomware.live. Incransom listed “PARTNERED HEALTH GROUP” (partneredhealth.com.au) claiming access on 23 June 2026, ~3.2 TB exfiltrated (~2.3M files) from 21 servers (AD + Best Practice medical + central SQL), 17,727+ named patient files, full staff HR including passports/AHPRA/tax docs, and a data period of 1999–2026 (27 years). Note: some secondary headlines inflate this to “32 TB”; the listing text cites 3.2 TB. Partnered Health previously confirmed a malicious actor accessed clinic data on 23 June 2026 and that PHI was taken from 21 clinics (see partnered-health-cyberattack2026) but had not attested the Incransom volume metrics at indexing. Catalog indexes 17727 as the actor-cited patient-file figure, labeled unverified.
Root cause
Unverified Incransom leak-site listing claiming 3.2TB exfil from Partnered Health (access date matches company-confirmed Jun 23 incident) — actor patient-file count not company-attested