For Sydney mother Chloe*, years had passed since she had thought about IVF company Genea, which she had used to receive donor eggs to become pregnant with her child over a decade ago.
Despite asking the company to dispose of her frozen eggs six years ago and having had nothing to do with them since, her data has now been compromised in a major data hack.
Genea was hacked in the early weeks of February and by late in the month the criminals reportedly began posting data relating to patients on the dark web. Some of the data stolen included contact details, Medicare card numbers, medical histories, test results and medications.
It has been almost a month now and I have emailed them and they still can't tell me what was stolen
Genea ex-patient
Chloe heard about the hack from media articles, but thought that – given she hadn't heard anything from the company – she wasn't impacted. She later received a message from them saying that she had been affected, but not specifying how.
"The communication has been really poor, they haven't told us anything and have kept us in the dark," she says. "It has been almost a month now and I have emailed them and they still can't tell me what was stolen," she says.
"I'm lucky I have already told my child about being born from a donor, because that information may be out there now," she adds.
Sensitive health data
University of Melbourne's professor of law and digital ethics Jeannie Paterson says under the law in Australia all health data is considered "sensitive data", and companies that hold it have greater responsibilities to protect it.
"Because this data is so sensitive it is very attractive to hackers, because the sensitive nature puts a lot of pressure on the company to pay a ransom rather than face the embarrassment of having this data leaked," she says.
While acknowledging that it takes time for the full extent of a data breach to come to light, Paterson says Genea should have done better at informing affected patients.
"Companies have an obligation to report data breaches to the Information Commissioner, but they also should have a plan in place for keeping people whose lives have been infected informed," she says.
"The level of trauma and uncertainty that happens to people when there's a data breach, it only goes up the longer they're kept in the dark, particularly when information is being published in screenshots in the dark web," Paterson adds.
Sensitive health data is particularly attractive to hackers.
OAIC and Genea respond
The Office of the Australian Information Commissioner (OAIC) declined to comment on the Genea hack specifically, but said of all sectors, the health sector had notified OAIC of the most data breaches since the notification scheme commenced in 2018.
"Organisations that collect, use and store personal information have a considerable responsibility to ensure that data is held safely and securely. This is very important for health service providers given the sensitive information they hold," an OAIC spokesperson says.
A spokesperson for Genea says they continue to liaise with the police and other authorities to investigate the data breach and that they will continue to update affected patients.
"We understand the importance that people place on their personal information and that this incident is concerning for those patients potentially impacted. Genea is committed to communicating with patients as swiftly and transparently as possible, and we apologise for any concern this incident has caused," the spokesperson says.
*Not her real name
We're on your side
For more than 60 years, we've been making a difference for Australian consumers. In that time, we've never taken ads or sponsorship.
Instead we're funded by members who value expert reviews and independent product testing.
With no self-interest behind our advice, you don't just buy smarter, you get the answers that you need.
You know without hesitation what's safe for you and your family.
And you'll never be alone when something goes wrong or a business treats you unfairly.
Learn more about CHOICE membership today
Stock images: Getty, unless otherwise stated.
