Australia Levies First-Ever Privacy Act Fine in Lab Breach

An Australian federal court has fined a medical lab AU$5.8 million for cybersecurity failures leading up to – and following – a 2022 cyberattack that affected 223,000 patients. The penalty marked the first time Australia has levied a civil monetary fine for violations of its Privacy Act of 1988.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

The court ordered Australian Clinical Labs to pay the penalty – equivalent to $3.8 million U.S. dollars – on Wednesday. The case stemmed from a February 2022 data encryption and exfiltration attack by cybercriminal gang Quantum Group on Medlab Pathology, which Australian Clinical Labs acquired in December 2021.

In the initial days and weeks after the attack, Australian Clinical Labs said it determined that no data had been exfiltrated and that a “notifiable” data breach had not occurred (see: Medlab Pathology Breach Affects 223,000 Australians).

These statements came despite an alert from the Australian Cyber Security Centre on March 25, 2022 advising the company that it had received “intelligence from a trusted third party that Medlab may have been a victim of a ransomware incident and reminded ACL that it may be required to notify the commissioner and affected individuals,” the court said.

Australian Clinical Labs continued to maintain that it “did not believe that any data had been exfiltrated.”

But on June 16, 2022, the Quantum Group on its dark website published 86 gigabytes of data exfiltrated from the Medlab IT systems. The stolen data included “personal information and sensitive information” covered under Australia’s Privacy Act.

That same morning, the Australian Cyber Security Centre sent ACL a second notice about the incident, saying the agency was aware that “potentially 80GB of Medlab data was published from the Quantum Group, and initial investigation by the third party” found that patients’ PII, protected health information and financial information is available on the web.

Australian Clinical Labs finally reported the data breach to government regulators in July 2022, and then in late October 2022 posted an “announcement” about the incident on its website, the court said.

That announcement included “a public apology from its CEO, provided details of the notification process and support services for affected individuals and confirmed that ACL would continue to work with the relevant authorities in relation to the Medlab cyberattack,” the court said.

Security Flaws Cited

Among other findings about the incident, the court said relevant security issues traced back to Dec. 19, 2021, when Australian Clinical Labs acquired Medlab, a privately owned pathology services business that offered services including prenatal genetic testing, fertility assessments and testing for sexually transmitted diseases.

“At the time of the acquisition, Medlab collected and held individuals’ personal and sensitive information in the course of its business. This information included health information, contact information, credit card information and payment details relating to more than 223,000 individuals,” court documents said.

“ACL did not identify certain relevant vulnerabilities in the Medlab IT systems prior to its acquisition of the Medlab assets,” the court said.

ACL established a steering committee in January 2022 to oversee and coordinate the integration of Medlab’s IT systems into ACL’s “core IT environment” by June 2022.

But at the time of the February 2022 incident, before Medlab’s IT systems were integrated into ACL’s core IT environment, the Medlab IT systems contained a range of cybersecurity deficiencies, the court document said.

That included the anti-malware software deployed by Medlab computers being incapable of preventing certain malicious files from being written or run on those systems; Medlab computers utilizing “weak authentication” measures; firewalls that could only log one hour of activity before logs were deleted; and no file encryption.

In addition to those weaknesses, Medlab’s network server “was running a legacy system of a Windows server that was not supported by Microsoft from Jan. 14, 2020; plus, the antivirus software deployed on the Medlab server did not prevent or detect a threat actor uploading data from the server to the internet,” the court documents said.

‘Extensive and Significant’ Violations

The Australian federal judge – Justice John Halley – in his ruling called ACL’s violations of Australia’s Privacy Act “extensive and significant.”

The breakdown of the civil monetary penalties include:

• A AU$4.2 million fine ($2.75 million USD) for ACL’s failure to take reasonable steps to protect the personal information held by ACL on Medlab Pathology’s IT systems, amounting to more than to 223,000 violations of the Privacy Act, or one violation for every individual affected by the breach;
• An AU$800,000 penalty ($524,103 USD) for ACL’s “failure to carry out a reasonable and expeditious assessment” of whether a reportable data breach had occurred;
• Another penalty of AU$800,000 ($524,103 USD) for ACL’s “failures” to provide the Australian Information Commissioner a statement concerning the reportable data breach, as soon as it was practical.

“ACL’s most senior management were involved in the decision making around the integration of Medlab’s IT systems into ACL’s core environment and ACL’s response to the Medlab cyberattack, including whether it amounted to an eligible data breach,” Halley said in his ruling.

The violations resulted from ACL’s “failure to act with sufficient care and diligence in managing the risk of a cyberattack on the Medlab IT systems,” the justice wrote.

“ACL’s contravening conduct had at least the potential to cause significant harm to individuals whose information had been exfiltrated, including financial harm, distress or psychological harms and material inconvenience,” he said.

The violations also “had the potential to have a broader impact on public trust in entities holding private and sensitive information of individuals,” the justice wrote.

Despite all that, the justice said he also identified several factors that reduced the final penalty that was imposed against Australian Clinical Labs. That included the company launching “a program of works to uplift the company’s cybersecurity capabilities.”

‘Turning Point’

In a statement, Carly Kind, Australian privacy commissioner, said the outcome in the incident represents “an important turning point” in the enforcement of the nation’s privacy law.

“For the first time, a regulated entity has been subject to civil penalties under the Privacy Act, in line with the expectations of the public and the powers given to the Office of Australian Information Commission, by Parliament.”

OAIC was the government body that pursued the legal action against Australian Clinical Labs.

“This should serve as a vivid reminder to entities, particularly providers operating within Australia’s healthcare system, that there will be consequences of serious failures to protect the privacy of those individuals whose healthcare and information they hold,” Kind said.

ACL employed approximately 5,400 people around the time of the incident and reported revenue of $697.1 million in the financial year ending June 2023, court documents said.

ACL did not immediately respond to Information Security Media Group’s request for comment on the court’s ruling and additional details about the incident.

Back in the US

In the United States, the Department of Health and Human Services’ Office for Civil Rights enforces the HIPAA security, privacy and breach notification rules around protected health information.

As of Thursday, OCR since 2009 has settled or imposed civil money penalties in about 176 cases involving HIPAA violations, totaling nearly $153.9 million in fines.

Those enforcement actions involved a wide variety of HIPAA-covered providers and business associates, including health insurers, hospital chains, clearinghouses, specialty medical groups, small physician practices, clinics, pharmacies, nursing homes, rehab centers and health IT services firms (see: Nursing Home Fined $182K for Posting Patient Photos Online).