Electronic prescriptions provider MediSecure says it has identified a cyber-security incident affecting the personal and health information of individuals.
According to the national cyber security co-ordinator, the company has suffered a ransomware attack.
"We have taken immediate steps to mitigate any potential impact on our systems," the company said in a brief statement on its website on Thursday.
"While we continue to gather more information, early indicators suggest the incident originated from one of our third-party vendors."
{loadposition sam08}In a post on X (formerly Twitter), Australia's recently appointed national cyber security co-ordinator Lieutenant-General Michelle McGuinness said on Thursday: "Yesterday afternoon I was advised by a commercial health information organisation that it was the victim of a large-scale ransomware data breach incident.
"I am working with agencies across the Australian Government, states and territories to coordinate a whole-of-government response to this incident.
"The @ASDGovAu Australian Cyber Security Centre is aware of the incident and the @AusFedPolice is investigating.
"We are in the very preliminary stages of our response and there is limited detail to share at this stage, but I will continue to provide updates as we progress while working closely with the affected commercial organisation to address the impacts caused by the incident."
The MediSecure statement said the company took its legal and ethical obligations seriously and appreciated this information would be of concern.
"MediSecure is actively assisting the Australian Digital Health Agency and the National Cyber Security Co-ordinator to manage the impacts of the incident. MediSecure has also notified the Office of the Australian Information Commissioner and other key regulators," it said.
"MediSecure understands the importance of transparency and will provide further updates via our website as soon as more information becomes available. We appreciate your patience and understanding during this time."
Home Affairs Minister Clare O'Neil said in a tweet: "I have been briefed on this incident in recent days and the government convened a National Co-ordination Mechanism regarding this matter today [Thursday]."