On 30 July the extortion group INC Ransom listed the Australian GP network Partnered Health on its leak site. The group claims to hold roughly 3.2 terabytes across more than two million files, drawn from a network of over 60 clinics. Partnered Health has since obtained an injunction restraining access to the data.
Both facts are worth sitting with, because a lot of Australian boards are about to ask the same question their lawyers just answered: can we get a court to make this go away?
What an injunction actually does
An injunction is a real and useful instrument. It creates legal jeopardy for anyone within reach of an Australian court who accesses, downloads, publishes or reports on the stolen data. In practice that means local media, local researchers, and any Australian business tempted to go looking through a competitor's records. It gives the organisation a lever to demand takedowns from hosts and platforms that do respond to legal process. It also signals to regulators and affected patients that the organisation is doing everything available to it.
For a healthcare provider holding clinical notes, Medicare numbers and referral letters, that is not a small thing. It narrows the audience.
What it does not do
It does not delete anything. The people who took the data are not in a jurisdiction that cares, and the infrastructure they publish on was built specifically to ignore court orders. An injunction cannot un-copy a file that has already been mirrored by half a dozen feeds, and it cannot reach the buyer who quietly downloaded a copy before anyone filed anything.
There is also an awkward second effect. A suppression order can make it harder for security researchers and journalists to describe what happened, which slows down the shared understanding that helps everyone else defend against the same group. That tension is real and there is no clean answer to it.
The two responses are not substitutes
The mistake we see is treating the legal response as the whole response, because it is the one that produces a document and a sense of momentum. It does not change your technical position at all.
If data left your network, the questions that decide your next six months are unchanged. How did they get in, and is that path closed. What identities did they touch, and have those credentials been rotated everywhere they were reused. What exactly left, in enough detail to notify accurately rather than notifying everyone with a worst-case letter. Whether your backups are clean enough to rebuild from, and whether you have tested that rather than assumed it.
None of those are legal questions. All of them determine whether you are dealing with one incident or the first of three.
What to do if you are watching this from the outside
Assume the data is out. Plan on that basis and treat any legal win as a bonus rather than the plan. Notify on the facts you can actually establish, and resist the temptation to wait for a clearer picture, because the picture usually gets worse before it gets clearer.
Then look at your own environment and ask the boring question. If someone published a directory listing of everything on your file shares tomorrow, how much of it would you struggle to explain, and how much of it should have been deleted years ago. That is the part you can still control.
