Cyber attack exposes personal data of sleep study patients at Women’s and Children’s Hospital

A ransomware attack has resulted in unauthorised access to the personal details of 2,254 patients at the Women’s and Children’s Hospital.

More than 2,000 patients that took part in sleep studies at the Women’s and Children’s Hospital have been affected by a cyber attack that accessed personal data, SA Health has revealed.

Department for Health and Wellbeing CE, DR Robyn Lawrence said they were advised by third-party company, Compumedics, that files of 2,254 patients who used the inpatient sleep service at the hospital could be among those impacted by the ransomware attack.

The technology providers became aware of “suspicious activity involving its network” on March 22.

They managed to restrict the unauthorised access on the same day.

Information related to patient’s name, postal address, contact details, emergency contact information (phone and email), sleep trial results and some limited clinical study notes were compromised in the attack.

“It’s incredibly disappointing that a third-party provider’s security systems were not sufficient to protect our patients’ data from outside access,” Ms Lawrence said during the announcement on Thursday.

Ms Lawrence said patients whose data has been compromised by the ransomware attack will be contacted by SA Health.

“As quickly as we were notified, we began working with Compumedics to identify exactly the patients that were impacted and the data that was taken,” she said.

Compumedics, whose systems were compromised in the attack, provides sleep study software equipment and electroencephalography to the Women’s and Children’s Hospital, Royal Adelaide Hospital, Flinders Medical Centre and Lyell McEwin Hospital.

“Compumedics has not advised SA Health that other Local Health Networks or hospitals are affected by the cyber incident,” SA Health wrote in a statement.

The Women’s and Children’s Health Network acted immediately to remove the Compumedics software and related devices from the network.

“There’s some very high tech pieces of equipment which need to managed appropriately, and we’re working with our clinicians to ensure that they can continue to deliver sleep studies as needed, while protecting our patients’ data,” Ms Lawrence said.

Opposition shadow health spokeswoman Ashton Hurn said the data breach was “incredibly concerning”.

“The government needs to do everything they can to protect people’s health data, get to the bottom of how this happened and ensure it doesn’t happen again,” Ms Hurn said.

Originally published as Cyber attack exposes personal data of sleep study patients at Women’s and Children’s Hospital