{"id":"elina-clinic-hotdoc-account-breach-jun-2026","category":"breach","status":"closed","title":"Elina weight-loss clinic confirms two HotDoc accounts accessed; attacker claims 28,000 patients' records","tldr":"Melbourne's Elina weight-loss clinic confirmed an unknown party logged into two HotDoc accounts. An attacker claims 28,000+ patients' details, including Medicare numbers, are for sale. As of 3 Nov 2026 we found no update. Past patients should watch for phishing.","summary":"Elina Medical Weight Loss Clinic, in Melbourne, confirmed that an unknown third party logged into two of its HotDoc user accounts. HotDoc is the booking and patient-messaging service the clinic uses. A threat actor calling itself \"2019\" listed the clinic on a hacking forum and claims to hold data on more than 28,000 patients across more than 300,000 records. The listed data is said to include names, addresses, dates of birth, email addresses, phone numbers, Medicare card details and appointment records. The actor is offering it for a one-time sale in cryptocurrency and included a sample, which has not been verified. The clinic says activity was limited to the two accounts, that the person no longer has access and that its wider IT systems are unaffected. When Cyber Daily reported on 19 June 2026, the clinic was still working out exactly what was accessed so it could notify affected patients. We found no later reporting on the findings, patient notices, a regulator report or the data being published, so the final scope is not known. There is no software fix involved, and nothing is known about use of the data.","action":"If you have been a patient of Elina, expect a notice from the clinic and treat unexpected emails, texts or calls about your health, Medicare or appointments as suspect. Use the clinic's published number, not one in a message, and use a password manager and multi-factor authentication.","product":"Elina Medical Weight Loss Clinic (Melbourne) patient records held in HotDoc","audience":"home","severity":"high","patch":"na","exploited":false,"cves":[],"tags":["data-breach","australia","health","hotdoc","medicare","clinic","extortion","account-access"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Exclusive: 2019 claims alleged cyber incident on Melbourne weight-loss clinic","url":"https://www.cyberdaily.au/security/13778-exclusive-2019-claims-alleged-cyber-incident-on-melbourne-weight-loss-clinic","by":"Cyber Daily","date":"2026-06-19"}],"started":"2026-06-19","closed":"2026-06-19","created":"2026-11-03T21:39:34.291Z","updated":"2026-11-03T21:39:34.291Z","cve_notes":[],"timeline":[{"at":"2026-06-19","added":"2026-11-03T21:37:06.107Z","kind":"other","text":"The clinic said the third party no longer has access, its wider IT environment is unaffected and it is operating normally. It said it was still working out which HotDoc information was accessed so it could notify affected patients, and had added monitoring and brought in authorities and cyber security experts.","url":"https://www.cyberdaily.au/security/13778-exclusive-2019-claims-alleged-cyber-incident-on-melbourne-weight-loss-clinic","by":"Cyber Daily","patch":"na"},{"at":"2026-06-19","added":"2026-11-03T21:37:06.107Z","kind":"disclosed","text":"Cyber Daily reported that a threat actor called \"2019\" had listed Elina Medical Weight Loss Clinic on a hacking forum, claiming data on more than 28,000 patients across more than 300,000 records. The clinic confirmed that an unknown third party had logged into two of its HotDoc user accounts, and said the incident was contained.","url":"https://www.cyberdaily.au/security/13778-exclusive-2019-claims-alleged-cyber-incident-on-melbourne-weight-loss-clinic","by":"Cyber Daily","patch":"na"}],"url":"https://hard.fyi/live/elina-clinic-hotdoc-account-breach-jun-2026/","json":"https://hard.fyi/api/live?id=elina-clinic-hotdoc-account-breach-jun-2026"}