Monash Health records exposed in ZircoDATA ransomware breach

Monash Health, one of Victoria's largest public health services, confirmed in early May 2024 that patient records it had sent to an external document scanning provider were caught up in that provider's ransomware breach. The provider, records management firm ZircoDATA, was listed as a victim by the Black Basta ransomware group on 22 February 2024, with the gang claiming roughly 395 gigabytes of data.

Monash Health said the affected material was archived documentation from the family violence and sexual assault support units at Monash Medical Centre, the Queen Victoria Hospital and Southern Health, limited to the period from 1970 to 1993. The service stressed that its own network and clinical systems were not compromised and that the exposure was confined to historical records held by ZircoDATA.

Chief executive Eugine Yafele said the organization was working "tirelessly and diligently" to verify who was affected and what data was involved, according to iTnews. Monash Health opened a dedicated phone line and email address, waived fees for Freedom of Information requests covering medical records, and pointed people to family violence and crisis support services including 1800RESPECT and Lifeline.

Neither Monash Health nor the outlets covering the disclosure put a firm figure on the number of individuals affected. Australia's National Cyber Security Coordinator, Lieutenant General Michelle McGuinness, called the development distressing and said work continued to identify every ZircoDATA customer whose data was taken. Melbourne Polytechnic and several government entities were also caught in the same incident.