Thousands of medical records and patient information stored with a major nationwide healthcare provider have been stolen in a cyberattack.

Partnered Health, owned by private equity firm Quadrant, said 21 clinics across several cities – including Sydney, Melbourne and Canberra – were hit in the June 23 breach.

“Our investigations to date have confirmed that personal information (including health information) was taken from some of the clinics in our network,” the company said on Wednesday.

“As a health services provider, we know our patients and our people trust us with personal and medical information and we sincerely apologise for any concern and inconvenience this may cause them.”

Partnered Health said it had reported the incident to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and law enforcement after “a malicious actor” accessed the data.

Personal information stolen includes names, dates of birth, addresses and contact details, as well as Medicare, private health insurance and concession card details.

Medical information and treatment details, including consultation notes, referral letters, and pathology or diagnostic results recorded by a GP were also breached.

Partnered Health has sought an interim injunction from the Supreme Court of NSW ordering the accessed data is not used or published.

Established in 2013, the company has more than 60 medical centres across Australia, as well as skin cancer, allied health and mental health clinics. Its services reach more than five million people.

Health insurer Bupa announced in June it was acquiring Partnered Health.

Data breach notifications to the Office of the Australian Information Commissioner reached a record high in 2025. Major incidents included an attack on Qantas that compromised the details of 5.7 million customers and reportedly leaked on the dark web.

The office said it received 1205 data breach notifications in the 2025 calendar year, up 8 per cent from 2024.

-AAP