Short answer
Icon Oncology Group, which runs the Icon Cancer Centre network, said on 12 October 2026 that someone accessed patient information held on a supplier's system. A hacker using the name '2019' says they hold more than 31,000 documents and is selling them, a claim Icon has not confirmed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Icon Oncology Group (Icon Cancer Centre) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare (cancer care) |
| Country | Australia |
| Detected | 2026-10-10 |
| Disclosed | 2026-10-12 |
| People or records affected | Not confirmed by Icon. A hacker claims more than 31,000 documents. |
What data was exposed
- Patient correspondence documents held on a supplier's system (per Icon)
- Claimed by the seller, unverified: patient names, addresses, diagnoses and Medicare details
- Details of consulting and treating doctors, seen in sample files (per Cyber Daily)
What happened
Icon Oncology Group is the parent of Icon Cancer Centre, which the Australian Journal of Pharmacy describes as Australia’s largest cancer care provider. Cyber Daily says it is based in South Brisbane and runs more than 40 centres in all seven states and territories.
On 10 October 2026 a hacker using the handle “2019” posted the data for sale on an underground forum, Cyber Daily reported. Icon published its own notice on 12 October, two days later.
What Icon has said
In its statement Icon said there was unauthorised access to some patient information held on a supplier’s system. According to Cyber Daily, Icon:
- activated its incident response plan and reset access to the affected system;
- brought in cyber security and forensic advisers;
- told the Australian Federal Police and relevant regulators;
- obtained a copy of the impacted records, and is checking which patients and what data are involved.
Icon believes the records are not complete patient files. It describes them as discrete documents linked to correspondence. Reports in the Australian Journal of Pharmacy and Health Services Daily report the breach too, though both articles are partly paywalled and we read only the opening paragraphs. Icon has not named the supplier.
What is a claim and what is confirmed
Confirmed by Icon: unauthorised access, a supplier’s system, correspondence-type documents, notification to the AFP and regulators.
Claimed by the seller: more than 31,000 “sensitive and confidential documents” with names, addresses, diagnoses and Medicare details, offered in a one-time cryptocurrency sale. Cyber Daily says sample files appeared to include details of consulting physicians, treating doctors and patient correspondence. None of the seller’s figures has been independently verified.
What is still unknown
- how many patients are affected;
- which supplier was compromised and how;
- whether any of the data has been sold or published;
- whether diagnosis or Medicare details appear in the files.
Staying safe
Health information is valuable to scammers because it makes a message believable. Someone who knows you are a cancer patient can play on fear, or pretend to be a clinic chasing a bill. Our guide to phishing messages shows how to check a sender. If a caller claims to be from a government agency, see government impersonation scams. For a step-by-step plan, read what to do after a data breach.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake breach notices posing as Icon, or as a compensation or 'claims' service, asking for clicks, Medicare numbers or fees
- Calls from someone claiming to be a doctor's office or Services Australia, citing a diagnosis
- Blackmail emails that say they hold your medical details and demand cryptocurrency
- Fake Medicare refund texts with a link to a lookalike myGov page
What to do if you are affected
- 01Wait for direct contact from Icon. Icon says it is working out which patients are affected, and genuine notices will come from Icon itself.
- 02Do not reply to or click links in unexpected messages that mention Icon, your diagnosis or a settlement. Phone the centre on a number from its official site.
- 03If Medicare details are confirmed as involved, ask Services Australia about replacing your Medicare card number.
- 04Report blackmail or scam contact to Scamwatch, and cyber incidents to ReportCyber (cyber.gov.au).
- 05Contact IDCARE (free) for help with identity misuse. You can also ask the OAIC about your rights if your information was mishandled.
- 06Do not pay anyone who says they will delete or return your data. Payment does not guarantee anything.
Frequently asked questions
Has Icon confirmed the Icon Cancer Centre data breach?
Yes. Icon described it as unauthorised access to some patient information held on a supplier's system. It has not said how many patients are affected.
Was Icon's own system hacked?
Icon says its own systems are secure and operating normally. The data came from a supplier's system, which Icon has not named.
Were Medicare numbers stolen?
The seller claims the documents include Medicare details. Icon has not confirmed that, and says it is still checking which data was taken.
Will my cancer treatment be affected?
Icon says patient care and treatment are not affected.
Who is the hacker behind '2019'?
Cyber Daily reports that the account appeared in January 2026 and focuses on Australian organisations. It has posted several alleged victims. Its identity is unknown.
Sources
- Exclusive: Australian patient data compromised in Icon Cancer Centre hack, Cyber Daily, 2026-10-12
- Icon falls victim to data breach, Australian Journal of Pharmacy, 2026-10-13
- Large Australian cancer services provider caught in data breach, Health Services Daily, 2026-10-14
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.