Epichealth runs four medical clinics in regional Victoria. It has confirmed that an unauthorised third party got into part of its IT systems and that patient data was compromised. The ransomware group The Gentlemen listed Epichealth on its leak site on 31 October 2026 and threatened to publish the data within 24 hours. As of Cyber Daily's 5 November report, no data had appeared. Epichealth posted a statement on its website on 4 November, and a spokesperson confirmed the incident to Cyber Daily. The company has not said how many patients are affected or what kinds of records were taken. Its investigation into the scope of the incident is still going.
What Happened
Epichealth's 4 November notice names the four clinics it runs: the Warrnambool Medicare Urgent Care Clinic, Epichealth Ocean Grove Marketplace, Epichealth Ocean Plaza and Epichealth Portarlington. The company says it "recently experienced a cyber incident, during which an unauthorised third party accessed a part of our IT systems". The notice does not say when the intrusion started or when it was found.
The Gentlemen claimed the attack in a leak-site post dated 31 October. Cyber Daily reports that the post promised to publish the data within 24 hours. That deadline passed, and when Cyber Daily published on 5 November nothing had been released. The group has given no other details about the attack. No ransom amount, data volume or file samples have been reported.
One point needs care. The victim profile for this listing on the tracking site cyberthreatintelligence.net, which draws on ransomware.live, describes a different-looking organisation: a Melbourne medical group called "Epic Health", founded in 2001, that runs brands including Alevia Medical Weight Loss. That does not match the four regional clinics Epichealth lists in its own notice, apart from the shared four-clinic count. The automated profile may have mixed up two similarly named providers. Readers should rely on Epichealth's own description of its operations.
What Was Taken
Epichealth has confirmed that patient data was compromised. It has not said what categories were exposed: Medicare numbers, identity documents, clinical notes, contact details or billing records. It has also not given a count of affected people. The Gentlemen has not published or described the data either. So this brief has no record count to report, and no estimate has been made public by the company, the attackers or any regulator.
This is a general practice and urgent care provider, so the exposure could include sensitive health information. That makes the eventual disclosure to the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme the key document to watch. No such filing has been made public yet.
Headline claims and verified figures often differ in Australian health breaches. In a separate, unrelated incident reported by The Nightly, a hacker said they had taken about 70GB from a NSW Health system. NSW Police put the figure nearer 4GB, and eHealth NSW said no patient data was involved. Until Epichealth or the regulator publishes numbers, any figure tied to this breach should be treated with caution.
Why It Matters
The group is very active, but victim counts vary widely. Published tallies of The Gentlemen's victims disagree:
- More than 320 victims in 17+ countries in one threat profile.
- About 72 victims in 2025 and more than 450 in 2026 (threatintel.co.nz).
- More than 800 victims (Acronis).
- 922 or 1,131 listed victims, both figures on the same cyberthreatintelligence.net profile.
- More than 1,570 linked victims, found on a compromised command-and-control server in 2026 (also cited on that profile).
Check Point, quoted by MyBroadband, attributed 17% of all ransomware attacks worldwide in July to the group. Every estimate agrees on the direction: the group grew fast in 2026.
Australia and New Zealand are being targeted. Threatintel.co.nz ranks The Gentlemen as the second most significant threat group for the two countries. It names New Zealand victims Worralls and Intracare, plus about ten other Australian organisations in 2026.
The affiliate model favours volume. Acronis and threatintel.co.nz both report that the group offers affiliates up to 90% of ransom proceeds, more than the 70 to 80% typical of other operations. That pulls in experienced intruders and access brokers. Acronis describes it as a Russian-language ransomware-as-a-service operation that appeared in mid-2025. Acronis says its operators previously worked as affiliates of LockBit and Qilin. Threatintel.co.nz also notes links to the Qilin ecosystem, and says Microsoft tracks the group as Storm-2697.
Paying does not guarantee deletion. MyBroadband reports that South African insurtech MIP Holdings paid The Gentlemen after a June breach and received promises that the data had been deleted. The group then kept leaking MIP's stolen data in separate batches, one for each affected client, including LegalWise, Samwumed and Guardrisk. Orange Cyberdefense told MyBroadband that the group's initial demands can start at US$500,000.
The Attack Technique
Epichealth has not said how the attackers got in. Nothing below has been confirmed for this incident. It is how the group and its affiliates are documented to work elsewhere.
- Internet-facing devices and stolen logins. Threatintel.co.nz reports a strong focus on VPN access, compromised credentials and internet-facing infrastructure. It says the group reportedly holds a large stock of already-compromised FortiGate devices that affiliates can use when they pick a target. The cyberthreatintelligence.net profile lists valid-account abuse (MITRE T1078) as a documented technique.
- Mass exploitation of edge systems. SOCRadar found exposed servers run by affiliates of the INC and The Gentlemen operations. Operator records on them showed exploitation of FortiClient EMS (CVE-2026-35616, 2,236 targets), SimpleHelp (CVE-2024-57727, 242 IP addresses) and cPanel (CVE-2026-41940). The same servers held a branded extortion package for a victim listed by The Gentlemen.
- AI-assisted intrusions. SOCRadar reports that these affiliates ran intrusions through AI coding agents, logging more than 8,000 messages and over US$23,000 in AI spending. They also used AI-managed knowledge bases to track victims and stolen credentials.
- Disabling security tools. Acronis observed a custom dropper loading vulnerable Safetica ProcessMonitor and Lenovo BootRepair.sys drivers to kill endpoint security processes before encryption. This is a "bring your own vulnerable driver" attack.
- Encryption across platforms, plus data theft. The group's encryptor is written in Go and targets Windows, Linux, NAS and BSD systems. Acronis describes a double-extortion model: files are encrypted and data is stolen to pressure victims with a leak threat.
What Organizations Should Do
- Patch and check edge devices now. Prioritise FortiGate, FortiClient EMS (CVE-2026-35616), SimpleHelp (CVE-2024-57727) and cPanel (CVE-2026-41940). If these were exposed before patching, assume compromise. Look for admin accounts nobody recognises and configuration changes.
- Lock down remote access. Require phishing-resistant MFA on every VPN, remote support and admin portal. Reset VPN credentials if a FortiGate appliance may have been compromised, because stolen device credentials are reportedly being stockpiled.
- Block known vulnerable drivers. Turn on Microsoft's vulnerable driver blocklist and alert on loading of Safetica ProcessMonitor and Lenovo BootRepair.sys drivers. Make sure endpoint security has tamper protection enabled.
- Protect backups and NAS devices. The encryptor targets NAS and BSD systems as well as Windows. Keep offline or immutable backups, and test restoring practice management and clinical systems.
- Watch for large data transfers out. Double extortion relies on stealing data before encrypting it. Alert on large uploads from clinical file shares and practice management servers, especially to cloud storage services.
- Prepare breach notification now. Healthcare providers should have Notifiable Data Breaches assessments and patient communications drafted in advance. The MIP Holdings case shows that paying does not stop leaks, so do not plan on payment buying deletion.
Sources: Exclusive: Epichealth Medical Clinics confirms ransomware-related d... | 2026 - Epichealth Medical Clinic - Your partner in health and wellb... | Epic Health Ransomware Attack by Thegentlemen (2026) Cyber Threat... | International actors responsible for ‘major’ NSW Health data breach... | Ransomware group threatens to leak customer data from top insurance... | #2 The Gentlemen – Threat Intelligence | INC and The Gentlemen Ransomware: Exposed AI Infrastructure | The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- se...