Information about a recent data security incident at Your Community Health

Last updated Tuesday 4 August 2026

Who this page is for

This page is for anyone who received a letter, email or SMS from Your Community Health about a recent data security incident.

It explains what happened, what information was involved, and what you can do to protect your personal information.

Please read it carefully, because the steps you may need to take depend on what information you gave us.

We understand this news can be worrying. We are sorry this has happened and we apologise for any distress it may cause. Your privacy and safety matter to us, and this is something we take very seriously.

We have contacted all individuals affected by text message, email or phone.

Health and clinical records

Health records held by Your Community Health have NOT been affected. This incident affected a small number of online forms only.

All people affected will be notified

This incident did not affect everyone who has submitted a form online. We have contacted all individuals affected by text message, email or phone.

What Happened

On 30 June 2026, we became aware of a data security incident involving our website. The Australian Cyber Security Centre (ACSC) contacted Your Community Health to advise of a breach affecting multiple websites across Australia. Some of our online forms held personal and health information, and this may have been accessed by an unknown third party.

Health records held by Your Community Health have NOT been affected.

This incident only involved information that people entered into some of the forms on our website.

Why it has taken time to contact you

When we found out about the incident, we acted immediately to make our website safe and to bring in experts to investigate. This kind of investigation is complex and takes time. We wanted to be sure we understood what happened, and that we had clear and accurate information before we contacted anyone affected by this.

This involved a number of steps:

We took immediate action to secure our website and prevent any further access.

We brought in specialist cyber security experts to investigate what happened.

We worked to identify which forms were affected and what information was involved.

We worked out who was affected, so we could give people information specific to their situation.

We prepared our team to answer questions and provide support and set up ways for people to contact us.

Once we understood who was affected and what information was involved, we began contacting people by email, text message and phone.

This incident did not affect everyone who has used our services. We have contacted everyone involved directly.

Data impacted

This involves information you gave us when you filled in a form on our website. Not all forms were affected. You can see the full list in the table below.

For most people, the information involved was what you typed into the form, which varies based on the form and enquiry type.

Personal information in affected forms includes one or more of the following :

Full name

Date of birth

Phone number

Email address

Home Address

Healthcare and concession card details

Services required

Medical information and/or history

Other personal details and/or sensitive information (such as, gender identity, disability status, country of origin, Aboriginal or Torres Strait Islander identity).

A small number of people also uploaded images of official identification, such as a driver licence or passport. *If this applies to you, we are contacting you directly by phone to talk through the extra steps you can take.

Important Information

This incident did not involve intake and referral forms for services, or our clinical and medical records systems.

Only some forms were affected

The table below shows the forms affected and the type of information we ask for in each form.

Forms affected	Standard information requested
Email newsletter form	Email address only.
RSVP to the YourCH Annual General Meeting	Name, email, phone.
Contact us	Name, email, phone, enquiry (this may include personal and/or sensitive information).
Booking enquiry form	Name, email, phone, services required, enquiry (this may include personal and/or sensitive information).
Private dental enquiry form	Name, email, phone, services required, enquiry (this may include personal and/or sensitive information).
Dental enquiry form	Name, email, phone, services required, enquiry (this may include personal and/or sensitive information).
Children’s dental enquiry form	Parent name, child name, email, phone, services required, enquiry (this may include personal and/or sensitive information).
Membership form	Name, home address, email, phone, other personal information, such as gender identity, disability status, country of origin, languages spoken.
Your Say: feedback form	Name, email, phone, other personal information, such as gender identity, disability status, Aboriginal or Torres Strait Islander, comments (this may include personal and/or sensitive information).
Access to health records form	Name, home address, email, phone, date of birth, relevant services, photo uploads of identity documents such as driver license, passport, Medicare.

What we have done

We have brought in a team of IT and cyber security experts who have been working with us to investigate what happened and secure our systems. Our website is now safe to use.

The incident has been reported to the Office of the Australian Information Commissioner.

We are also reviewing:

how we collect and store the information given to us through our online forms

extra security measures, including stronger firewall protection, malware scanning and more regular security checks.

So that we can fully understand what happened and lower the chance of it happening again, our investigation is still ongoing. However, your privacy and safety matter to us and we are asking people to follow the steps below as a precaution.

What you can do to protect yourself

We recommend you be alert to any emails, text messages or phone calls you did not expect, including things that look like they come from someone you know or trust.

More ways to protect your information:

Check the identity of the sender before responding, including checking email addresses and phone numbers.

Do not click on links or open files in messages that look unusual or unexpected.

If you are unsure whether a link or offer is genuine, go directly to the organisation’s website or contact them using details you already have, rather than the details provided in the message.

Never give your personal details, passwords or bank details to someone who contacts you over the phone, email or SMS.

Check your bank accounts for unusual activity and contact your bank straight away if you notice anything suspicious.

Check the strength of your passwords and whether they have been involved in any data breaches on the Victorian Government password strength tester website https://service.vic.gov.au/find-services/personal/password-strength-tester.

Follow the Australian Competition and Consumer Commission’s Scamwatch guidance for protecting yourself from scams here: https://scamwatch.gov.au.

Advice for specific types of information

These steps only apply if you gave us this type of information.

Type of information	What you can do
Healthcare and concession card details	A concession card number on its own cannot be used to access your account and cannot be used as proof of your identity. For more information, visit servicesaustralia.gov.au/databreach
Medicare card number	If your Medicare card number has been exposed in a data breach, you can get a replacement Medicare card by logging into myGov or contacting Services Australia on 132 011. Your replacement card will have a new issue number and expiry date. This means your old card will no longer be valid.
Medical information and/or history	This information could be used to make a scam message seem more convincing. Be careful with any unexpected contact that mentions your health or your care.
Sexual orientation, or other sensitive personal details	This is private information that could be used to make a scam seem convincing. Be alert to unexpected contact. If you ever feel unsafe about a request you believe is from Your Community Health, please contact us to verify the information. In an emergency call the police on 000.
Images of official identification (such as a driver license or passport)	These can be misused to steal your identity. If this applies to you, we will also be contacting you directly by phone.

Who can I contact for more information about cyber security?

The are several official government organisations established to help individuals protect their personal information.

OAIC: the Privacy Commissioner has dedicated data breach support and resources: https://www.oaic.gov.au/privacy/your-privacy-rights/data-breaches/data-breach-support-and-resources.

IDMatch: Commonwealth, state and territory governments provide free guidance on how to protect government issued documents as a result of a data breach: https://www.idmatch.gov.au/individuals/data-breach.

ASD: the Australian Signals Directorate’s Australian Cyber Security Centre provides advice and information about how to protect yourself online: https://www.cyber.gov.au/protect-yourself https://www.cyber.gov.au/protect-yourself

ReportCyber: you can report a cybercrime or incident by calling 1300 292 371 or online: https://www.cyber.gov.au/report-and-recover/report.

If you are feeling distressed

We understand it can be upsetting to learn that your personal or health information may have been affected in a cyber incident. If you need support during this time, there are a number of free services that provide online or phone help: