Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

PARTNERED HEALTH GROUP

Claimed by Incransom · listed 8 hours ago

Today
Age
since listed · data leaked

Status timeline

  1. ListedJul 30, 2026
  2. Data leakeddate unknown

At a glance

Group
Incransom
Status
Data leaked
Country
Australia
Sector
Healthcare
Listed on leak site
Jul 30, 2026

About the victim

AI dossier — public-source company profile

Partnered Health Group operates 60+ primary care, occupational health, psychology, and telehealth clinics across five Australian states and territories under multiple brands including Partnered Health Medical Centres, Jobfit, Baseline Onsite, New View Psychology, and others. Owned by Quadrant Private Equity, the group is pending acquisition by Bupa for approximately AUD $450 million (announced July 2026).

Industry
Healthcare — Primary Care, Occupational Health, Psychology, Telehealth
Address
Australia (NSW, QLD, VIC, WA, ACT) — 60+ clinic locations nationwide
Employees
51-200

Attack summary

Severity: critical — Confirmed exfiltration of 3.2 TB spanning 27 years of sensitive health records (17,727+ patient files), staff personally identifiable information (passports, tax files, medical registrations), and regulated healthcare databases. Includes Australian healthcare system data (Medicare, DVA), AHPRA-regulated practitioner records, and Bupa corporate/financial data. Scale, sensitivity, regulatory jurisdiction (Australian Privacy Act, HIPAA-equivalent), and impact on pending $450M acquisition elevate to

incransom claims to have exfiltrated 3.2 TB of data (2.3 million files) from 21 servers across 21 clinic locations on 23 June 2026, including complete patient medical records spanning 27 years (1999–2026), full SQL database dumps (ZedMed, Payroll, DocPays, VectraplexECG), staff HR records with passports and tax declarations, and Bupa corporate billing data and session cookies. The group is threatening staged publication unless negotiations resume within 10 days.

critical

Data the group says was taken

AI dossier — extracted from the leak post
  • Patient medical records (17,727+ named files)
  • Consultation notes, referral letters, pathology results
  • Diagnostic imaging reports and prescriptions
  • Complete ZedMed patient management database
  • Payroll database (all staff salaries)
  • DocPays database (doctor payments)
  • VectraplexECG cardiac/ECG monitoring data
  • 11 Best Practice clinic patient database backups
  • Staff HR files (employment contracts, passports, AHPRA registrations, tax declarations, superannuation)
  • Bupa corporate data (billing agreements, fund tables, patient invoices, session cookies)
  • QuickBooks financial records (2004–2026)
  • Medicare billing and DVA remittances
  • RACGP accreditation files and clinical audit data

What the group claims

PARTNERED HEALTH GROUP — Australia ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Industry: Healthcare — Primary Care, Occupational Health, Psychology, Telehealth Headquarters: Australia (NSW, QLD, VIC, WA, ACT) Owner: Quadrant Private Equity Clinics: 60+ nationwide Brands: Partnered Health Medical Centres, Jobfit, Baseline Onsite, New View Psychology, NewPsych, Australian EAP, Fuel Your Life, Northcare Physio, TeleWell Website: partneredhealth.com.au PENDING ACQUISITION: Bupa — ~$450,000,000 AUD Announced July 2, 2026 (Australian Financial Review) ACCC and FIRB regulatory approval pending. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BREACH SUMMARY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Date of access: 23 June 2026 Data exfiltrated: 3.2 TB Total files: 2,298,203 Servers accessed: 21 (9 AD Controllers + 11 Best Practice Medical Servers + 1 Central SQL Server) SQL Databases: ZedMed.mdf, Payroll.mdf, DocPays.mdf, VectraplexECG.mdf, BPM.mdf + 1,104 SQL backups Clinics compromised: 21 locations across 5 states/territories Patient records: 17,727+ named patient files identified Staff HR files: Full employee records including passports, AHPRA registrations, tax declarations Period of data: 1999 — 2026 (27 years) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT WE HAVE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ▪ Complete patient medical records from 21 GP clinics — consultation notes, referral letters, pathology results, diagnostic imaging reports, prescriptions ▪ Full SQL database dumps — ZedMed (patient management), Payroll (all staff salaries), DocPays (doctor payments), VectraplexECG (cardiac/ECG monitoring data) ▪ 11 complete Best Practice patient database backups — one per clinic — including BPSPatients, BPSDocuments (up to 48 document partitions per clinic) ▪ Staff HR files — employment contracts, passport scans, AHPRA medical registrations, tax file declarations, superannuation details, performance reviews ▪ Bupa corporate data — direct billing agreements, fund tables for all Australian states, patient invoices, corporate program documents (Bronze/Silver/Gold), and active Bupa web portal session cookies ▪ Financial records — QuickBooks databases (2004-2026), Medicare billing, DVA remittances, private health fund claims ▪ Clinical governance — full RACGP accreditation files, patient consent templates, internal clinical audit data ▪ 27 years of accumulated medical data (1999-2026) across ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ TO PARTNERED HEALTH / QUADRANT PRIVATE EQUITY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Partnered Health was given the opportunity to resolve this matter privately and protect patient data. Instead of acting in the interest of their patients, they spent 22 days in silence, hired lawyers, and obtained a court injunction that has no practical effect outside Australian jurisdiction. Their public statement of July 15 describes the breach as affecting "some" data from "some" clinics. This is misleading. The reality: 3.2 terabytes. 2.3 million files. 21 servers. 27 years of patient medical history. Every clinic server in their network was accessed. Complete SQL database dumps were taken including the central patient management system and payroll for every employee. And critically — the data includes Bupa's own corporate information: billing agreements, fund pricing tables for every Australian state, named patient invoices, and active browser session cookies from Bupa's login, corporate, and web portals. We understand this acquisition matters. $450 million is a significant transaction. A full data publication would create material regulatory complications with the ACCC and FIRB review process. We trust the board and advisors at Quadrant understand what that means. This is not a threat. This is a deadline. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DEADLINE: [DATE + 10 DAYS] ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Partnered Health has 10 days to resume negotiations and reach a settlement. If no agreement is reached: Stage 1 — Complete file tree listing (2.3M files) + all HR/staff records published Stage 2 — SQL databases (ZedMed, Payroll, ECG) released for download Stage 3 — Bupa corporate data, fund tables, billing agreements, session data published. ACCC, FIRB, and Bupa executive leadership notified directly. Stage 4 — Full 3.2 TB data dump made available for public download.

Sources

Source

Indexed 8 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About Incransom

Incransom is a ransomware group that emerged in August 2023, operating with primarily financial motivations as evidenced by their targeting of high-value sectors across multiple developed nations. The group's origin and specific affiliations remain undocumented by major threat intelligence organizations, though their operational patterns suggest they likely operate independently rather than as a ransomware-as-a-service model. With 734 documented victims, Incransom has demonstrated a preference for targeting organizations in the United States, Canada, United Kingdom, Germany, and Australia, with particular focus on healthcare, technology, business services, and manufacturing sectors, though their attack methodology and specific technical capabilities have not been extensively documented by established security researchers or government agencies. The group's notable campaigns and specific high-profile victims have not been publicly detailed by CISA, FBI, Mandiant, or other reputable threat intelligence sources, suggesting either operational security effectiveness or limited visibility into their most significant operations. Based on available intelligence, Incransom appears to remain active as of recent reporting periods, though comprehensive analysis of their current operational status requires additional documentation from established threat intelligence sources. The group has been linked to 1,736 public disclosures across our corpus. First observed on a leak site on September 9, 2021; most recent post July 30, 2026. The operation is currently active.

Also tracked as: inc ransom, INC.

Timeline of this disclosure

  • July 30, 2026PARTNERED HEALTH GROUP listed by Incransomon the group's public leak site

Other recent disclosures by Incransom

Incransom has been linked to 1,736 public victims on Darkfield. A sample of the most recent:

See the full Incransom dossier →

Sector and geography

This disclosure adds to ransomware activity in the Healthcare sector, which has 2,603 disclosures indexed across all operators we track. Geographically, PARTNERED HEALTH GROUP is reported in Australia, a country with 185 ransomware disclosures in our corpus.

If your organisation is affected

A listing by Incransom means PARTNERED HEALTH GROUP appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Report the incident to your national CERT, ACSC (Australia), as required for your jurisdiction.
  • Monitor for the data appearing on Incransom's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.