On October 17, 2022, Australian Clinical Labs (ACL) disclosed a data breach that occurred in February 2022 impacting Metlab Pathology, a business that was acquired by ACL in December of 2021. ACL is a leading Australian healthcare company that performs pathology services to approximately ninety (90) hospitals and conducts 6 million tests annually. In a cyber security incident and data breach notification for Metlab Pathology, ACL explained that Metlab became aware of unauthorized third-party access to its IT system in February 2022. Metlab was then contacted by the Australian Cyber Security Centre (ACSC) in March 2022 and was told that the company potentially suffered a ransomware attack. Metlab confirmed that it did not believe any information had been compromised in March but had communications with ACSC again in June 2022 and was told that information had been posted on the dark web. Through forensic investigations, ACL determined that 223,000 individuals have been affected by the data breach, with the majority being located in NSW and Queensland. The records that were exposed were also determined to include roughly 17,500 “individual medical and health records associated to a pathology test”, approximately 28,200 “credit card numbers and individuals’ names”, and roughly 128,600 Medicare numbers (not copies of cards) and an individual’s name.” ACL emphasized that there is currently no evidence of misuse of the exposed information or demand made by Quantum, the threat actor responsible, of Medlab or ACL. Quantum uploaded the 86 gigabytes (GB) of leaked data in June, which consisted of “patient and employee details, financial reports, invoices, contracts, forms, subpoenas, and other private documents.” CTIX analysts will continue to monitor for data breaches across the globe involving sensitive information and report details as necessary.