Epworth-Hospital Listed by global Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare providers worldwide, exploiting the sector’s reliance on continuous operations and the sensitivity of the records it holds. Against that backdrop, Epworth-Hospital was listed by the ransomware group global on 28 May 2025, an event that has drawn attention because of the organisation’s role in Australian private hospital care and the claim that internal files were taken.

Public reporting so far is limited to the group’s leak-site listing and a brief description of the organisation. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. The listing itself is a claim by the group rather than a verified disclosure by the hospital.

Inside the incident

According to the available record, Epworth-Hospital was listed by the global ransomware group on 28 May 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No further operational details—such as the initial access method, the duration of any intrusion, encryption of systems, or the volume of data taken—have been disclosed in the public summary. The number of individuals potentially affected is listed as unknown. Because the information originates from a threat-actor listing, it should be treated as an unverified claim until corroborated by the organisation or official investigators.

Who is global?

Global is a ransomware operation that, like many contemporary groups, has been observed using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Such groups typically maintain leak sites where they name victims and, in some cases, release samples of stolen files to increase pressure. Public reporting on global has described activity consistent with this model across multiple sectors, though the precise tools, affiliates, or negotiation practices used in any single case are rarely confirmed outside of the group’s own statements. In this instance, the only concrete assertion tied to Epworth-Hospital is the listing itself and the claim of internal-file exfiltration; no additional statements by the group about this victim have been recorded in the available facts.

Epworth-Hospital and its sector

Epworth HealthCare is a leading not-for-profit private hospital group based in Victoria, Australia. Founded in 1920, it provides medical, surgical and rehabilitation services and operates major hospitals across Melbourne and Geelong. As a private healthcare provider it sits within a sector that routinely manages large volumes of clinical, administrative and personal information. Hospitals of this type are attractive targets for ransomware operators because disruption can affect patient care and because the data they hold is both sensitive and potentially valuable on criminal markets. A listing of this kind therefore raises immediate questions about continuity of care and the protection of patient and staff records, even when the precise scale remains unconfirmed.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of those files—such as patient records, staff details, financial documents or clinical systems—has been publicly named. Organisations of this kind typically hold medical histories, contact information, billing data, insurance details and operational records. Because the exact contents remain unconfirmed, it is not possible to state which specific categories were involved. The number of people affected is also unknown.

The real-world impact

For individuals, the principal risks associated with exfiltrated hospital files include identity theft, fraudulent use of personal or medical information, and potential privacy harms if clinical details become public. Even when the precise data set is unknown, the mere possibility of exposure can create lasting concern for patients and staff. For the organisation, a ransomware incident can interrupt clinical workflows, require costly recovery and forensic work, and damage trust among the communities it serves. Because the listing is attributed to a ransomware group, there is also the secondary risk that any released material could be further circulated or sold. At present these impacts remain potential rather than documented outcomes, given the limited public detail.

What to do if you're exposed

If you have been a patient, staff member or contractor of Epworth-Hospital and are concerned that your information may have been involved, practical first steps include the following:

• Monitor bank, credit-card and government-service accounts for unexpected activity and enable multi-factor authentication wherever available.
• Request a free credit report or identity-monitoring service if you live in a jurisdiction that provides them, and place fraud alerts if you notice suspicious inquiries.
• Be cautious of unsolicited emails, calls or messages that reference medical appointments, bills or personal details; treat them as potential phishing attempts.
• Keep records of any correspondence you receive from the hospital or from authorities about the incident.
• Run a free exposure scan of your email address against known breach data sets to check whether your details have already appeared in public or criminal dumps.

Official notifications, if any are issued by Epworth HealthCare or Australian regulators, should take precedence over third-party claims. Until more detail is confirmed, measured vigilance remains the most useful response.

AICompiled with AI assistance from public sources and published under our editorial standards.