Genea IVF confirms sensitive patient health information on dark web

Australia Broadcast Center

5 days ago

Patients of Australia's third-largest IVF provider, Genea, have been informed that their sensitive information — including medical history — has been posted on the dark web.
The update comes more than five months after the ABC revealed cyber criminals had targeted the fertility clinic, which is used by tens of thousands of people across the country.
In emails sent to affected patients over the past few days, Genea CEO Tim Yeoh confirmed the company had wrapped up its probe into the February cyber attack: "We are not notifying you about a new incident".
Emails obtained by the ABC state the data includes patients' full names, addresses, dates of birth, and "clinical information related to the services that you received from Genea or other health service providers and/or medical treatment".
A former Genea patient told ABC News the communications appeared to downplay the significance of the data leak.
The email claimed information was found on "a part of the dark web, which is a hidden part of the Internet" and "not readily searchable or accessible on the Internet".
"We understand that this news may be concerning for you, and we unreservedly apologise for any distress that this may cause you,' the email stated.
The patient, who did not want to be named, had spent tens of thousands of dollars undergoing multiple unsuccessful rounds of IVF with the clinic between 2022 and 2024.
She told the ABC Genea had obtained her full medical history as part of the onboarding process.
"There is genetic information which really affects my family. There is information about mental health. It's your whole history.
"That information could be used against you. And it could really change the course of your life."
On Tuesday, Genea informed the patient her full name, phone number, address, date of birth, Medicare number, medical diagnosis and clinical information had been posted on the dark web, in an email she said was another example of the company minimising the breach.
She said companies like Genea should be held accountable for allowing customer data to be stolen and she intended to seek compensation.
"A lot of people chose Genea because they present themselves as personal, but except when something goes wrong, they just go quiet and close the doors and don't talk," she said.
"You have got no rights. The big corporation is just going to steamroll everyone."
Do you know more? Confidentially email [e-mail]
Genea would not confirm how many patients were affected by the breach, the name of the cybercriminal group claiming responsibility, or whether a ransom was paid — in full or in part.
Nor would the company provide a copy of the investigators' report into the breach.
In a statement, a Genea spokesperson said the company had "concluded its investigation into the cyber incident which impacted our organisation in February".
"This included a comprehensive analysis of the data published on the dark web to identify impacted individuals and the personal information relating to them."
"We are now starting to communicate with individuals about the findings from our investigation that are relevant to them, and the steps and support measures in place to help them protect their personal information.
The company said the AFP was still investigating the cyber attack and it was working with the Office of the Australian Information Commissioner, the National Office of Cyber Security, the Australian Cyber Security Centre and relevant state departments.
The spokesperson said: "Genea has partnered with IDCARE, Australia's national identity and cyber support service, to provide counselling and other services to patients at no cost if they wish to seek further support."
The data breach at Genea is one of a string of incidents affecting Australian companies in recent years including Optus, Medibank, Latitude, and, most recently, Qantas.
Like Qantas, Genea obtained a court-ordered injunction to prevent anyone from publishing or sharing the stolen data.
However, cryptography expert Vanessa Teague criticised the use of such injunctions, saying they were ineffective at stopping cyber criminals.
"It's really effective for preventing law-abiding journalists from publishing," she said.
Dr Teague said the publication of sensitive medical records online highlighted the urgent need for stronger privacy protections in Australia.
"It's important to recognise that if the data has been accessed, it could have financial value — to insurance companies, to advertising companies — both of those clusters of companies.
"We need much stronger privacy laws that hold the source of the data breach accountable."
Dr Teague said Australian companies handling personal data should face the same legal obligations as those in the European Union.
"If you hold sensitive data from other people, you should have high obligations to keep it secure — like in Europe. And if you fail in that responsibility, you should be held accountable," she said.
She also warned that Australia's current approach prioritised corporations over victims.
"There's a continuing attitude that the companies are the victims. As long as we hold that view, we'll never hold them to account."