[News](/news) Cybercriminals targeting Australian health sector [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Cybercriminals targeting Australian health sector ##### [Edward Kost](/team/edward-kost) November 26, 2020 There's a disturbing increase in cyber attacks targeting the Australian Health sector. This trend was observed by the Australian Cyber Security Centre (ACSC), a government agency tasked with monitoring Australia’s cyber threats. [The ACSC has flagged two threats](https://www.cyber.gov.au/acsc/view-all-content/alerts/sdbbot-targeting-health-sector) under high alert - SDBBot Remote Access Tool (RAT) and CI0p. The SDBBot is an insidious remote access weapon that grants attackers unmitigated remote control of an infected system. Once installed, the SDBBot will autonomously download additional components to establish remote access. The SDBBot will then move throughout the network of the compromised system and exfiltrate data. The ACSC has not identified any cyber crime groups linked to these attacks, however, the SDBBot RAT is an attack method almost exclusively used [by cyber crime group Hive 0065](https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/) (also known as TA505). According to the ACSC, the SDBBot is a precursor to CI0p ransomware. [CI0p ransomware](https://malpedia.caad.fkie.fraunhofer.de/details/win.clop) is used to target high profile companies, it’s operatives refer to themselves as “Clop.” The ransomware attempts to disable WIndows Defender and remove Microsoft Security Essential to evade detection. Cyber attackers install the CI0p ransomware in the final phase of a SDBBot - CI0P attack. Once enough sensitive data has been breached, it’s encrypted and held hostage. If victims fail to pay the ransom price, the breached data is [published on the dark web](https://www.upguard.com/blog/dark-web). The cybercrime group behind CI0p ransomware attacks follow through with their threat of publishing breached data if victims don’t pay. On October 3, CI0p [breached German tech company Software AG](https://www.arnnet.com.au/article/683615/software-ag-data-downloaded-after-malware-attack/) and demanded a ransom payment of $20 million. To prove sensitive data was compromised, the cyber crime group published a screenshot displaying Software AG employee emails, financial records, a passport and ID scans. The software giant failed to pay and their breached data was published online, as promised. But the threat of a ransomware attack against the health sector is of much greater concern than the software industry. Ransomware attacks completely lock victims out of their internal systems and in a hospital this could result in the death of patients relying on networked systems. The ACSC observed that the health industry was the highest targeted sector in the 2019-2020 financial year Cyber criminals are not just targeting the Australian health industry. On September 27, one of the largest healthcare providers in the United States, Universal Health Services, [fell victim to a ransomware attack](https://techcrunch.com/2020/09/28/universal-health-services-ransomware/). The health sector in Australia, and globally, needs to [desperately improve its security posture](https://www.upguard.com/product/breach-risk) to protect patients from the pernicious threat of ransomware. ## How secure is The Australian Government Department of Health? The Australian Government Department of Health develops and implements national policies and programs related to healthcare, aged care, disability services, medical research, disease control, and public health initiatives. The department administers programs including the National Immunisation Program, Medicare mental health services, the Hearing Services Program, and the National Disability Insurance Scheme. * View our free preliminary report on The Australian Government Department of Health’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View The Australian Government Department of Health's score](/security-report/australian-government-department-of-health) [View score](/security-report/australian-government-department-of-health) [https://www.health.gov.au/](/security-report/australian-government-department-of-health) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)