Icon Oncology Group (Icon Cancer Centre): patient information on a supplier system accessed without authorisation; AFP and regulators notified; Australia-only so far
Icon Oncology Group said on 12 October 2026 that it is managing a data breach involving unauthorised access to some patient information held on a supplier's system, and that at this stage the incident appears to affect Australia only. The group says it activated its incident response plan, reset access to the affected system, engaged specialist cyber security and forensic advisers, and notified the Australian Federal Police and relevant regulators. It has obtained a copy of the impacted records and is confirming which patients and what information are involved, and says it will contact those patients and their treating doctors directly. Icon believes the records are discrete documents associated with business correspondence rather than complete patient files, and says the Group's own systems are secure and operating normally with patient care and treatment unaffected. Icon Cancer Centre is headquartered in South Brisbane and describes itself as Australia's largest dedicated cancer-care provider, with more than 40 centres. Cyber Daily (12 Oct) reported that a forum actor using the handle 2019 had offered more than 31,000 documents allegedly tied to the centre (claiming names, addresses, diagnoses and Medicare details); treat that forum claim as unverified wire context pending Icon's patient notifications. Primary: Icon Group notice (12 Oct 2026, last updated 3:15pm AEST).
- Product
- Icon Oncology Group / Icon Cancer Centre patient information held on a supplier system
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Patients and treating doctors: watch for Icon contact; treat unexpected medical or Medicare phishing as high risk. Healthcare providers: map which patient correspondence and supplier systems hold PHI, reset third-party access on suspicion, and notify AFP/OAIC paths early. Practitioner page: /knowledge/my-health-record-breach.
Primary: Icon Group — Important notification – data breach incident (12 Oct 2026) · Vendor: Icon Cancer Centre (Australia) · Cyber Daily — Australian patient data compromised in Icon Cancer Centre hack (12 Oct 2026)