Patients of St Vincent’s Health Australia, the country’s largest not-for-profit operator of aged care homes and hospitals, are in the dark about whether their personal information was stolen a week after a cyberattack on the organisation was first detected.

St Vincent’s detected anomalies in its IT systems on Tuesday, December 19, notified the government that day and went public on Friday, confirming that data had been stolen but offering no detail on what information had been taken or how.