For years, the people who defend Australia’s hospitals, clinics and health databases have warned that their sector sits at the wrong end of a dangerous equation: it holds some of the most sensitive data in the country, yet runs on some of the most stretched budgets and oldest systems. Now a fresh warning suggests that gap is about to be exploited at a scale the sector has never seen, with artificial intelligence handing attackers tools that were once the preserve of nation states.
The alarm was captured bluntly in a report published by the Canberra Times, which quoted an industry figure describing what is heading toward the health sector in three words: “the wave is coming”. The phrase is designed to unsettle, and it lands because the sector already knows how badly a single breach can hurt.
Why AI changes the maths
Cybercrime against healthcare is not new. What is new is the speed and polish that generative AI brings to the attacker’s side of the ledger. Phishing emails that once gave themselves away through clumsy grammar can now be written flawlessly, in a nurse’s or administrator’s own tone, and tailored to a specific roster or billing cycle. Voice cloning can turn a thirty-second snippet of a manager’s speech into a convincing phone call authorising a payment or a password reset. Malware can be reshaped on the fly to slip past detection tools that rely on recognising known patterns.
The effect is to collapse the cost of a competent attack. A criminal who previously needed real technical skill can now rent or prompt their way to the same result, which means far more actors can target far more organisations at once. For a sector made up of thousands of small clinics, aged care providers, pathology labs and allied health practices sitting alongside a handful of large hospital networks, that democratisation of attack is precisely the problem. The weakest link is no longer rare, and AI is very good at finding it.
The optimists are not silent
There is a genuine counter-argument, and it deserves airing. The same technology that arms attackers is reshaping defence. AI-driven security tools can sift billions of log entries to spot the faint signature of an intrusion in minutes rather than weeks, flag unusual access to patient records, and automate the grind of patching and monitoring that under-resourced IT teams simply cannot keep up with by hand. Several of the security vendors operating in Australia now pitch “autonomous” defensive systems built on exactly this premise, arguing that only machine-speed defence can answer machine-speed attack.
The honest position sits between the two camps. AI raises the ceiling for well-funded defenders while lowering the floor for attackers, and the organisations most exposed are the ones that can afford neither the best tools nor the specialists to run them. In health, that describes a very large share of the sector. The optimistic case is real, but it is not evenly distributed, and a big teaching hospital’s investment does little for the suburban practice that still runs an unsupported operating system on the reception desk.
What it means for Australia
Australians have already lived through the worst-case version of a health data breach. The 2022 attack on Medibank exposed the records of roughly 9.7 million current and former customers, including deeply sensitive information about medical procedures, and it reshaped the national conversation about how carelessly this data had been held. My Health Record, the national digital health system, concentrates vast quantities of clinical information in one place, which makes the stakes of a successful intrusion national rather than local.
Canberra has not been idle. Health was formally brought under the Security of Critical Infrastructure regime, which imposes obligations on operators to manage and report cyber risk, and the federal cyber strategy set a goal of making Australia a world leader in cyber resilience by 2030. The Australian Signals Directorate‘s annual threat reporting has repeatedly flagged that cybercrime is rising in both volume and cost, and that critical services including health remain prime targets. The policy scaffolding, in other words, exists. The question is whether it reaches far enough down the chain to protect the small operators who make up the bulk of the sector and hold the data that criminals want.
There is also a trust dimension that matters more in health than almost anywhere else. People will walk away from a retailer that loses their email address. They cannot walk away from the system that holds their mental health history, their pregnancy records or their HIV status. A wave of AI-enabled breaches would not just cost money and disrupt care, it would corrode the willingness of Australians to share information their clinicians need, which carries its own clinical risk.
What happens next
The near-term agenda is practical rather than glamorous. Boards of health providers are being pushed to treat cyber risk as a patient-safety issue rather than an IT line item, because a ransomware attack that locks a hospital out of its own records can stop surgery and divert ambulances. Expect more pressure on supply chains, since many breaches arrive through third-party software and billing providers rather than the front door. Expect, too, continued debate about whether smaller providers need direct funding or shared security services, given that compliance obligations mean little if an operator cannot afford to meet them.
The regulatory direction of travel points toward tougher reporting, mandatory baseline controls and closer scrutiny of how AI is used on both sides of the fence. For a sector that has spent years being told the threat was theoretical, the message now is that it is operational. Whether “the wave” breaks as badly as the warning suggests will depend less on any single new technology and more on how quickly the least-protected corners of Australian healthcare can be brought up to a defensible standard. On current evidence, that race is tight.
Sources: The Canberra Times.
