31,000 Cancer Patients' Records Are for Sale. Australia’s Privacy Law Stops Protecting You the Moment You Die

The number that matters is 31,000. That is how many "sensitive and confidential documents" a threat actor operating under the handle "2019" claims to have pulled from a supplier to Australia's largest dedicated cancer care provider, Icon Cancer Centre, and put up for sale on an underground hacking forum. Names. Addresses. Diagnoses. Medicare details. Correspondence between consulting physicians and the patients they were treating.

Icon confirmed the incident on 12 October in a notice on its website: unauthorised access to some patient information held on a supplier's system. The company says it has obtained a copy of the affected records and is working out exactly who is affected and what was taken. Its own systems, it stresses, are secure. Treatment continues.

There is a digital-estate story buried in this breach that almost nobody has told yet, and it is the reason NYLK is writing about it today. Icon is a cancer care provider. Over more than 40 centres, it has treated a lot of people, and a great many of the patients in its files are now dead. Cancer is, bluntly, a disease people die of. If 31,000 documents from a cancer network are now circulating on a criminal forum, the dead are almost certainly in that dataset.

The dead cannot change a password

When you die, your digital estate stops being able to defend itself. You cannot be phished, but you also cannot be warned, cannot rotate a credential, cannot freeze a file, cannot ask a credit bureau to place an alert, and cannot tell whether your name and diagnosis are being traded for cryptocurrency right now. That asymmetry is the entire point. A living patient exposed in a breach can at least act. A dead one is permanently, structurally exposed.

Australian privacy law makes this worse in a way that is genuinely counter-intuitive. The Privacy Act 1988 (Cth) does not protect deceased individuals at all: the Act's definition of "individual" has been read as a living person. The Australian Law Reform Commission recognised this gap back in its 2008 report For Your Information and recommended extending coverage to people who had been dead for 30 years or less. The government of the day did not accept it. That recommendation has never been enacted.

What exists instead is a patchwork of state rules for health information specifically, and those rules protect the data but almost never the estate's power over it.

Health records survive you. Your executor's access does not.

In New South Wales, the Health Records and Information Privacy Act 2002 continues to protect a person's health information for 30 years after the date of death. That sounds reassuring until you read the next line, straight from the NSW Information and Privacy Commission's own fact sheet: after you have passed away, neither your relatives nor the executor of your will has a right under the Act to access your health information. The same applies to whoever was your authorised representative while you were alive.

Victoria takes a slightly different route. Under s 95 of the Health Records Act 2001, the Act applies to someone who has been dead for 30 years or less "so far as it is reasonably capable of doing so," and access rights are exercisable by the legal representative of the deceased, the executor or administrator. In practice, as medical indemnity insurer Avant explains in its guidance to doctors, the executor or administrator generally has to produce probate or letters of administration before a practice will hand over anything, and clinicians are told to release information for compassionate reasons only in carefully bounded ways.

So Australia has settled on an awkward compromise: the data stays protected, but the person who has the clearest reason and standing to protect it, the executor, has only a thin, state-dependent, request-shaped ability to act, and no statutory right at all in the Commonwealth Act.

The "un-breach" problem

Here is where the framework meets reality and loses. The protection that survives death assumes the data is still where it should be: in a hospital system, held by a provider, subject to a privacy regime. A breach breaks that assumption completely.

Once 31,000 documents are offered for sale on a forum, they are no longer governed by the Health Records and Information Privacy Act. They are a file on a criminal's machine. There is no application process, no fact sheet, no access request that gets a compromised record back. Erasure, which we rightly treat as a core digital-rights idea, is functionally impossible once data has left the building and been sold. For the living, that is a serious problem. For the dead, it is total: nobody is on the other end of the obligation, and nobody has the legal standing to demand a remedy that the platform could not deliver anyway.

Why this is a digital-estate story, not just a breach story

Australians have been slow to absorb a simple fact: your digital estate is not only the accounts you log into. It is every record that other people hold about you, your health data, your insurer's notes, your correspondence with clinicians, and those records have a life span that can exceed your own by decades. NSW and Victoria will protect your health information for 30 years after you die. Your cancer care provider may be legally required to keep your records for at least seven years, with no carve-out for the deceased.

And yet Australia still has no equivalent of the American RUFADAA, the Revised Uniform Fiduciary Access to Digital Assets Act, which, across 47 US states and DC, gives executors a defined legal pathway into a deceased person's digital accounts and records. Australia has no such statute, and the Law Reform Commission's proposals on third-party access to digital assets after death remain a consultation paper, not law.

The result is a country where your health data is protected for 30 years after death, your executor cannot straightforwardly reach it under Commonwealth law, and the moment a supplier is breached, the protection evaporates and the data becomes somebody's listing on a forum, with no mechanism, in law or in practice, for the dead person or their family to claw any of it back.

What to do about it while you can

The Icon breach is a live investigation. Icon says it has notified the Australian Federal Police and regulators, and affected patients should watch for direct communication from the provider, not from random email or phone contact. But the parts of this that you can control belong in your estate plan now, not later:

• Name the records in your digital directive. Health records, insurer files and provider correspondence are digital assets. Tell your executor they exist, where they are held, and what you want done with them.
• Understand the access gap. Your executor may need probate just to request your health records. Don't assume "my family can just ask." In NSW they often can't.
• Treat a breach as permanent. If you or a deceased family member appears in a data leak, plan for the data being out there forever. There is no erasure and no recall.
• Review the providers in your life the way you review your passwords. The breach didn't happen inside the cancer centre. It happened inside a supplier. Your risk lives in the third parties your providers trust.

Thirty-one thousand documents are, according to the person selling them, in criminal hands. Some of the people in those files are still in treatment. Some are already gone. Australian law goes to considerable lengths to keep the records of the dead private, and then has almost nothing to offer when a stranger with an anonymous handle sells them to the highest bidder.

Sources: Icon Group breach notification (12 Oct 2026); Cyber Daily, "Australian patient data compromised in Icon Cancer Centre hack"; NSW IPC fact sheet, access to a deceased person's health information; Avant, deceased patients and their medical records; ALRC Report 108, privacy of deceased individuals; Health Records and Information Privacy Act 2002 (NSW).