Services Australia matches breach data on 31,044 medical group patients

Services Australia has commenced a data matching program using customer information provided by Southern Regional Medical Group about people affected by the medical group’s March 2025 data breach, in order to prevent, detect and address fraud relating to Centrelink or Medicare details. The program is set out in a notice published in the Commonwealth of Australia Gazette under reference C2026G00700 and registered on 27 October 2026. The notice identifies Services Australia as the matching agency and Southern Regional Medical Group as the source entity.

How the matching will work

Services Australia will compare the data supplied by Southern Regional Medical Group against Medicare program and Centrelink program customer records. The stated aim is to let the agency identify affected customers deemed compromised and apply proactive security measures to detect and address fraud.

The notice says the initial analysis provided by the organisation indicates that there may be approximately 31,044 impacted customers. That figure is described as an estimate arising from the medical group’s own preliminary assessment, not a confirmed count of compromised records.

Where a government related identifier — such as a Medicare number or a Centrelink Reference Number (CRN) — was disclosed, or reasonably expected to have been disclosed, as part of the breach, the notice lists the categories of data passed to Services Australia, to the extent captured and available:

• government related identifier
• customer name
• customer date of birth
• customer address

Safeguards and published protocols

The notice states that Services Australia adheres to the OAIC Guidelines on data matching in Australian Government administration and to the National Health (Data-matching) Principles 2020 (Health Principles), which include standards for data matching activities.

A protocol document describing the program has been published by the agency under the title Data matching activities for third party organisation data breaches – Services Australia. The agency’s privacy policy is also cited in the notice as the reference point for how the matched information is handled.

Beyond those references, the notice does not set out a completion date, a review timetable or a numerical tally of matches already made. It records the commencement of the program and the legal and administrative framework under which the comparison of records proceeds.

Why the identifiers matter

The data categories at issue are the identifiers that link a person to government payments and health entitlements: a Medicare number or CRN paired with a name, a date of birth and an address. Matching those records is what allows the agency to determine whether a leaked identity is being used against a live Commonwealth account.

For the roughly 31,044 people caught up in the Southern Regional Medical Group breach, the practical consequence is that their Medicare or Centrelink details may now be checked against their own records without any action on their part. Where a record is judged compromised, Services Australia says it will apply proactive security measures — which places the response to the leak inside the federal payments system rather than solely with the breached medical practice.

The notice is one of a series of data matching notices covering third party organisation data breaches, and it confirms that the March 2025 incident continues to generate administrative consequences for patients more than eighteen months after the breach itself.

Source: Commonwealth of Australia Gazette, C2026G00700, 27 October 2026, Government Notices (official reference: C2026G00700).