Icon Oncology Group said on 12 October 2026 that it is managing a data breach involving unauthorised access to some patient information held on a supplier's system, and that at this stage the incident appears to affect Australia only.

Its notice (last updated 15 October 2026, 8:15am AEST) states the incident involved an externally hosted and managed platform that converts incoming faxes to email — not Icon's main system for sending or receiving patient information — that it was contained immediately, and that core clinical and patient management systems were not affected, with all systems online and patient treatment unaffected.

The group says it activated its incident response plan, reset access to the affected system, engaged specialist cyber security and forensic advisers, and notified the Australian Federal Police and relevant regulators. It has obtained a copy of the impacted records and is confirming which patients and what information are involved, and says it will contact those patients directly; people who may be concerned can also register for an update via privacy@icongroup.global.

Icon believes the records are discrete documents associated with business correspondence rather than complete patient files. Icon Cancer Centre is headquartered in South Brisbane and describes itself as Australia's largest dedicated cancer-care provider, with more than 40 centres.

Primary: Icon Group notice (12 Oct 2026, last updated 15 Oct 2026 8:15am AEST).

Correction (23 Oct 2026): removed a forum seller's unverified claim about the number and content of documents; Icon's own notice is the only source for what was accessed. (source: https://icongroup.global/en/news/2026-10-12/important-notification-data-breach-incident/)