St Andrew's Hospital - Patient Data Downloaded, a Limited Statement, and the Exemption Health Never Had

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

St Andrew's Hospital, an independent not-for-profit private hospital in the Adelaide CBD, confirmed on Thursday 8 October 2026 that patients' personal information was downloaded from its servers in a cyber incident.

What the hospital said. Its CIO, Nathan Crettenden, told the ABC an internal investigation "identified that a subset of data from our servers was downloaded", and that systems were taken offline as a precaution and forensic specialists engaged. CEO Angela McCabe said the investigation had "progressed to the point where we can communicate directly with affected individuals, in line with our regulatory obligations". The OAIC and the ACSC have been notified. The SA Premier, Peter Malinauskas, said the government expected to be briefed, including on whether SA criminal law was broken.

What was taken. The hospital has confirmed only personal information of "a group of individuals". 7NEWS reported the data included names, phone numbers, home addresses, email addresses, dates of birth, Medicare card numbers and healthcare identifiers. No information has been released on clinical records or payment data.

Unknown. The number of people affected (the hospital declined to say), when access began and was detected, the attack vector, whether ransomware was involved, and whether there has been a demand. No group had claimed the attack at the time of writing.

Lessons. Minimise identifiers you store, such as Medicare numbers and IDs, and segregate the ones you must keep. The Privacy Act's small-business exemption ($3m turnover) does not apply to health service providers holding health information, so even small clinics are covered by the Notifiable Data Breaches scheme: assess suspected breaches within 30 days and notify affected people and the OAIC as soon as practicable. Have a containment plan and a decision-maker ready. Communicate clearly about what you know, what you don't, and when you'll update. Affected individuals can contact Services Australia about Medicare card concerns and IDCARE for support.

Visit www.kinsoft.com.au to talk through your security and IT needs.

Sources: ABC News (8 Oct 2026); 7NEWS; YourLifeChoices; St Andrew's Hospital; OAIC (Notifiable Data Breaches scheme; small business exemption guidance).