A ransomware attack on a Toowoomba pharmacy has resulted in the leak of sensitive patient data, including medical records and NDIS information. The DragonForce ransomware group has claimed responsibility, highlighting the growing threat to Australian healthcare providers.
Australian Clinical Labs (ACL) has agreed to a $5.8 million penalty following a 2022 data breach at its subsidiary, Medlab Pathology. The breach, orchestrated by the Quantum ransomware group, exposed the sensitive data of 223,000 Australians, prompting regulatory action from the OAIC.
WestJet has issued a further notice on its June cyber incident, confirming passenger data was exposed though payment details remain secure. The update comes amid rising aviation cyberattacks, including a recent Collins Aerospace breach that disrupted major European airports.
A ransomware attack on a Toowoomba pharmacy has resulted in the leak of sensitive patient data, including medical records and NDIS information. The DragonForce ransomware group has claimed responsibility, highlighting the growing threat to Australian healthcare providers.
Cyber News Centre's cyber update for 2nd October 2025: Toowoomba's Friendlies Society Dispensary has become the latest Australian healthcare provider to be targeted by ransomware, with the DragonForce group claiming responsibility and leaking sensitive patient data.
Friendlies Society Dispensary is a community-owned pharmacy in Toowoomba, Queensland, providing a range of services including mobility supplies, home modifications, and support for NDIS participants.
The Update: The DragonForce ransomware group has claimed responsibility for a cyberattack on the Friendlies Society Dispensary in Toowoomba, releasing 35.82 gigabytes of data on the dark web. The September breach exposed patient medical records, vaccination details, NDIS information, and staff payroll files. Some of the data includes names, addresses, treatment histories, and scans of employee identity documents. The pharmacy’s CEO, Bayden Johnson, has acknowledged that the full extent of the breach is not yet known.
In a statement to the ABC, Friendlies Society Dispensary CEO Bayden Johnson confirmed the scope of the breach was still being investigated. “As soon as this incident was detected, we immediately worked to secure our systems and to establish a clear picture of what happened,” Johnson said. “We are working as a priority to determine exactly what information this data contains so we can ensure that all appropriate steps are taken.”
The pharmacy has engaged with multiple government agencies, including the Australian Cyber Security Centre and the Department of Home Affairs. Johnson added that the full extent of the data breach is not yet known.
Why it Matters: This incident underscores how even smaller regional healthcare providers are being targeted by sophisticated cybercriminals. The exposure of sensitive medical and disability records not only risks identity theft and fraud but also poses serious personal consequences for affected individuals, including distress over highly private treatment information being made public.
For the broader sector, this attack is a reminder of the persistent rise of ransomware against healthcare. Former Minister for Home Affairs and Cyber Security Clare O’Neil previously noted that health organisations are among the “most common, and most damaging, targets of cyber attack.” Smaller operators, in particular, often lack the defences of larger hospitals, making them vulnerable points in Australia’s healthcare system.
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
Australian Clinical Labs (ACL) has agreed to a $5.8 million penalty following a 2022 data breach at its subsidiary, Medlab Pathology. The breach, orchestrated by the Quantum ransomware group, exposed the sensitive data of 223,000 Australians, prompting regulatory action from the OAIC.
WestJet has issued a further notice on its June cyber incident, confirming passenger data was exposed though payment details remain secure. The update comes amid rising aviation cyberattacks, including a recent Collins Aerospace breach that disrupted major European airports.
Volvo Group North America has disclosed a data breach exposing employee data after a ransomware attack on its HR supplier, Miljdata. The incident highlights the growing threat of supply chain attacks and their far-reaching consequences.
Perth-based operational technology firm Intellect Systems has been targeted by the Akira ransomware group, which claims to have stolen 10GB of sensitive corporate and personal data. The attack highlights the growing threat to the critical infrastructure sector through vulnerable network devices.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
