Australian Clinical Labs accused of 'sitting on' hack that saw patient data posted to the dark web

Cybersecurity experts are questioning why it took one of Australia's biggest pathology services five months to tell its patients that data had been stolen and posted to the dark web. Key points: Pathology company ACL says it first learned of the attack in February but believed no data was stolen The company says it told the relevant authorities about the data hack in July, after learning details were on the dark web However, it only told customers that their data had been hacked and some of it posted to the dark web this week Australian Clinical Labs yesterday revealed it was hit by a cyber attack eight months ago, in February, and that since then it had found out the data of 223,000 people had been accessed and some of it posted to the dark web. "ACL took immediate steps to find and download this highly complex and unstructured data-set from the dark web and made efforts to permanently remove it," the company said in a statement. "The OAIC has ongoing preliminary inquiries with Medlab to ensure compliance with the requirements of the Notifiable Data Breaches scheme," the OAIC said in a statement to ABC News. "The release of that person's address is likely to result in serious harm in a way that the organisation wouldn't necessarily conclude by itself," Professor Bennett Moses said.