SteadyPoint Cyber
13 October 2026 · SteadyPoint Cyber

15,000 Patient Scans Are on a Leak Site, and the Backups Were Taken Too

Note: the practice has not published a staff count or made a public statement that I could find, and the group's claims have not been independently verified. The group is new, so its claims should be read with that in mind.

On 11 October a ransomware group called N0n added an Australian neurology practice to its leak site, with a countdown showing that the data would be published at 11:37pm AEDT on 13 October. The ransomware.live tracker has matched the listing to Hunter Neurology and records the group's claim as 15,252 patient images and scans, 11,819 patient letters and reports, 439 laboratory results, 839 patient record system files and four complete weekly backups of the practice's medical records system. The same entry marks the data as not paid and exposed, which suggests the deadline has passed, although the tracker warns that claims from a group this new should be treated with caution until someone confirms them.

We don't know how the group got in yet. N0n first appeared in mid-September and has posted about 77 victims in 27 countries, mostly transport and shipping operators, so a medical practice is an unusual catch for it. The techniques the tracker lists for the group as a whole include stolen valid accounts and remote desktop access, which is also the most common route into small businesses, but that is a description of the group and not a finding about this practice.

The detail worth noticing is the backups. If the group really holds four weekly copies of the whole records system, those copies were probably stored somewhere reachable with the same access used to take everything else. Backups are supposed to be the sprinkler system, and a sprinkler system that the fire can switch off is more of a decorative feature.

Why this matters to your business

Think of backups and an incident plan the way a building manager thinks about fire exits. Nobody expects the building to be fireproof, and the goal is only that when there is a fire the sprinklers work, the staff know which door to use, and the business opens again as soon as possible. A practice that holds patient records has the same need as any other small business that keeps client files, and it has it with the staff and budget of a small business. The health sector has been the top reporter to the OAIC, with 225 notifications in 2025, so the target is well understood by the people choosing victims.

The part that usually goes untested is the recovery. Most owners can say they have backups, but far fewer have ever restored one, or checked that the person with the login can be reached on a Sunday, or written down who to ring first.

Three things to actually do this week for reassurance

  1. Find out where your backups live and who can reach them. If the login that opens your main system can also delete the backups, ask your IT provider to set up at least one copy that cannot be changed or erased from there, such as an offline drive that is disconnected or a cloud copy under a separate account.
  2. Restore one file from your backup and time it. Pick something ordinary, like last month's invoice folder, and see how long it takes and who has to be involved. If nobody knows how, you have found the gap while it costs nothing.
  3. Write down the first three phone calls. That means your IT provider, your insurer's cyber hotline if you have one, and someone who can advise on notification duties under the Privacy Act, with the numbers kept somewhere that is not on the computer that has just been locked.

By the numbers

This week's odds

Which of these would you actually bother worrying about?

Pick a card to see the odds of it happening to you in a given year. Then see where your business sits.

0 of 4 revealed

Sources

Sources for the odds graphic

    ← All posts