About a decade ago, Nicole gave her close friend a life-giving gift that she has told very few people about.

Nicole, whose name we have changed to protect the privacy of all involved, donated eggs to her friend and husband so they could fulfil their dream of becoming parents.

Her friend gave birth to a child from an embryo using Nicole’s fertilised egg — a child who today is happy and thriving, but does not yet know they were conceived from a donor egg. 

“I was just happy to be a part of the process, just to give her and her family what she really wanted.” 

Nicole is what is known as a non-anonymised donor, meaning the child has the legal right to request information about her once they turn 18. 

But a major cyber attack on fertility giant Genea earlier this year means their deeply personal medical information is no longer private.

As patients call for the firm to be held to account, the ABC can reveal ongoing concerns about the company’s cybersecurity. 

IVF data in hands of cybercriminals

Genea Fertility is Australia’s third-largest IVF provider, acquired in 2022 by private-equity firm Liverpool Partners, and describes itself as “focused on sustainability” and “driven by financial returns”. 

After it was revealed in February that sensitive information had been stolen, in July the company confirmed the types of information — including the medical histories of patients and donors — that had been posted on the dark web.

In August, Nicole and her friend received emails from Genea confirming their personal information was among the data stolen.

“It was a range of medical information, personal information such as name, date of birth, but also my medical history, my ancestry, my ethnic background, medical conditions I’ve had in the past,” Nicole said.

For Nicole and her friend, the realisation that their private IVF journey is now in the hands of cybercriminals has been devastating.

“There was an apology, there was an acknowledgement that it’s an inconvenience,” she said.

“But it felt quite … yeah, depersonalised. It was, ‘This has happened, this is what was leaked, and sorry.'”

Genea has obtained a Supreme Court injunction preventing anyone from publishing or sharing the stolen data. But cybersecurity experts point out that criminals do not follow court orders.

The injunction also prevents affected patients — or journalists — from viewing the material on the dark web to understand what has been taken.

Nicole said she had been unable to obtain any further details from Genea beyond the company’s generic email.

“Maybe it serves a purpose for Genea, but it doesn’t give people affected the right to understand what exactly was taken from them without their permission,” she said.

“Criminals will do whatever they want and that’s out of our control — injunction or otherwise.”

Calls for further security review of Genea systems

As the fallout from Genea’s recent data breach continues, a report has been lodged with the Australian Cyber Security Centre recommending a review of one of the fertility company’s applications used by customers.

The report was submitted by ethical hacker Jamieson O’Reilly, whose firm specialises in identifying weaknesses in cybersecurity systems for major companies here and abroad.

Mr O’Reilly says his submission, which is supported by mobile security researcher Noah Farmer, did not suggest Genea’s systems were unsafe or that customer data was at heightened risk, but aimed to encourage a review of the application’s design to make sure it was current best practice.

A spokesperson for Genea confirmed the company had received Mr O’Reilly’s report, but would not comment specifically about its contents. 

Instead, Genea provided a statement that related to questions about the February data breach, in which it apologised for the incident and said it continued to support victims.

“At the time of the incident in February, Genea engaged a team of cybersecurity experts to conduct a thorough investigation and review the impacted data,” the statement said.

“We are committed to learning from this incident and we have already taken steps to further strengthen our security upon the advice of external experts to mitigate the risk of future cyber incidents,” the statement said.

Medical data not deleted at patient request

Former Genea patient Rebecca Craven is worried about the security of her personal data, which the company has refused to delete.

The mother of three went through the clinic in early 2018 for basic genetic testing when she and her husband unexpectedly fell pregnant with their daughter.

“At the time, I just wanted to find out whether or not the baby was happy and healthy as soon as possible,” she said.

While she was not affected by the February data breach, her request for Genea to delete her personal information was rejected in an email seen by the ABC, citing legal requirements. 

However, as Rebecca pointed out, the seven-year legal requirement under her state’s legislation had already expired.

She believes she should have the legal right to ask for her data to be deleted, something experts agree would help combat the growing impact of mass data theft.

“It’s my daughter, and if it’s not medically necessary to have that data on somebody’s systems, I don’t see why I shouldn’t be able to say, ‘Please delete this data.'”

Tip of the data breach iceberg?

While Genea IVF did eventually come clean about some of the details of the February cyber attack, there are growing concerns Australians are being kept in the dark about how widespread cyber attacks are, and that current reporting thresholds protect companies from reputational damage.

“There’s a balance — we don’t want onerous obligations that stifle organisations in a free market, but Australian consumers rightly want their data protected.”

Mr Dellys said he was aware of at least one incident that he believed met the reporting threshold for notifiable data breaches, but the company determined otherwise. 

“Ambiguity has been exploited, so some breaches that should be declared weren’t,” he said.

In an interview with The Business, national cyber security coordinator Michelle McGuinness admitted not all companies were reporting breaches as required.

“We can only encourage people to call in, even if it’s just to help complete the threat picture. We can’t deal with what we don’t know.”

Some cybersecurity experts the ABC spoke to have argued that even when incidents are reported to regulators as required, the current system acts like a “confessional box”.

That’s because under the limited-use obligation, if a company voluntarily shares details of a cyber incident with the government, that information can only be used to help manage or prevent the incident — not to fine, prosecute, or take regulatory action against the company.

However, Lieutenant General McGuinness insisted that companies that did report were referred to regulators when needed.

“If someone has used a limited-use obligation, we will know because they’ve advised us, and we’ll be very clear on their obligations,” she said.

“They report back to us when they’ve met those obligations.”

No formal investigation launched into Genea

Unlike other data breaches at major companies such as Qantas, Medibank and Optus, Genea has not confirmed how many patients were affected by the cyber attack, or explained how cybercriminals were able to break into its systems and steal data. The ABC’s questions again went unanswered. 

In a statement, a spokesperson for Genea said the company has maintained “ongoing liaison with respective government bodies, including the Office of the Australian Information Commissioner, the Australian Federal Police, the national cyber security coordinator and the Australian Cyber Security Centre in relation to this incident”.

However, the ABC can reveal the Office of the Australian Information Commissioner (OAIC) has yet to decide whether it will formally investigate Genea.

Richard Buckland from UNSW, who researches cybercrime, hacking and hackers, has called on the OAIC to take regulatory action against Genea. 

He said that while the number of affected people would not be as high as the Medibank cyber attack, the sensitivity of the data stolen was comparable.

“The impact is at least as big, if not bigger,” he said.

“The data loss here and the effect on people’s privacy and the effect on people’s mental well-being is potentially vast. I can’t actually imagine a worse one.

“Fertility goes to some of the things we hold most dear and where we’re most vulnerable, and people who go to an IVF clinic are often in an incredibly stressed situation. I just cannot think of a worse sort of data to lose to criminals.”

Professor Buckland said the Information Commissioner here is our main line of defence, and has the power to enforce penalties, and she sets the standards and the tone.

At least one class-action law firm, which said it had been contacted by hundreds of Genea IVF patients, has lodged a complaint with the regulator.

Nicole said she and her friend planned to join any legal action launched against Genea. 

However, she is calling for the OAIC to act. For Nicole and her friend, the Genea data breach has broken their trust and created immense anxiety. 

“The expectation from medical institutes or other health professionals is that when it’s provided, it’s protected,” she said.

“I would like to see Genea held accountable in the courts for what they’ve done through the voices of the people that were affected by it.”