Cyber Security Incident  

Ascot Vale Health Group (AVHG) was recently alerted to activity on our systems which indicated a potential cyber incident had occurred.

Unfortunately, our investigations have identified that a subset of data held by AVHG was accessed and taken from our systems by an unauthorised third party. This data included some patient information.

Please note our core patient database has not been affected and our medical centre remains open to all patients, so that we can continue to provide the highest quality care.

We take the privacy and protection of personal information very seriously.

This statement outlines the types of personal information that may have been affected, the steps we have taken to date, and the steps that individuals can take to reduce the impact to their personal information.

What information may have been impacted?

Contact Information – name, date of birth, address, email address and/or phone number

• • Please look out for scammers – including suspicious emails, texts, phone calls or messages on social media. Never click on any links that look suspicious, never provide your passwords, or any personal information.
    
    
  •  Consider changing your online passwords. Use strong passwords and enable multi-factor authentication for your online accounts where possible.

Health Information – health information impacted by the incident could include details of the diagnoses, treatment or recovery of a medical condition, as well as other health information contained within referral letters, medical results or imaging, treatment plans or medical reports

• We acknowledge and understand that it may be upsetting to have your health information accessed in this matter. If you are experiencing any distress, we recommend that you seek health advice from a registered health professional you know and trust.  

Beyond Blue is also available to provide support to individuals affected by the cyber incident.  The Beyond Blue Support Service is available 24/7 for counselling.  It is free and confidential (local call costs apply).  If you wish to speak with a Beyond Blue Counsellor, they can be contacted via phone on 1300 22 4626 or you can chat to a counsellor online.  You can learn more about the Beyond Blue Support Service on their website.

Medicare Card Number, Centrelink Customer Registration Number or Concession Card Number

• Your Medicare card number alone cannot be used to verify your identity or access your Medicare account.

If you are concerned about the security of your Medicare account, you can contact Medicare to obtain a replacement card free of charge. You can do this by using your:

• • Medicare online account through MyGov
  • the Express Plus Medicare mobile app
  • calling the Medicare program
    
    
• If you care concerned about the security of your Centrelink account you can contact Services Australia to put additional authentication measures in place.
• If your concession card has been impacted, you do not need to get a replacement card, and you can continue to use it as usual.

Please note that we generally do not collect or store patient identity documents or financial information.

If you need more details about the information that may have been impacted by the incident, please contact cyberincident@avhg.com.au

Additional Preventative Measures

In addition to the above, you can find further information about online safety, cyber security and helpful tips to protect yourself at the following websites:

1.      Ways to protect your privacy | OAIC

2.      ACCC's Scam watch website

3.      Protect yourself | Cyber.gov.au

What actions has AVHG taken? 

Once aware of the incident, we worked urgently to contain the threat and investigate what occurred. We also engaged external cyber security experts to assist with our investigation and response to the incident.

We have followed the recommendations made by our cyber security experts and are confident that all appropriate steps have been taken to remediate the incident.

We have also reported the incident to the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC).

Conclusion

We regret that this incident has occurred, and we would like to apologise for any concern or inconvenience this may cause you.