However, it appears the hackers – and several open source threat feeds that took the hackers at their word – appear to have either mistaken the data in their possession or were deliberately hyping its importance.

“The AMC is aware of the claims made by ThreeAM that they have published data obtained from the AMC. The AMC has reviewed the data and are confident that this is not AMC data and that there has been no data leakage from the AMC,” an AMC spokesperson told Cyber Daily

“The AMC has no role in the delivery of health services and does not hold any patient data.”

Nonetheless, the AMC said it has reported its findings to the Australian Cyber Security Centre.

ThreeAM has already published the entire data set, and multiple documents feature the letterhead of the Aghapy Medical Centre in Victoria, as well as several personal files belonging to one of its general practitioners. The documents include details of business processes, blank forms, and general correspondence, as well as patient complaints and the transfer of patient records.

No patient records appear to be included in the data.

Cyber Daily has been in touch with the Aghapy Medical Centre, which has declined to comment on the incident.

Who is ThreeAM?

According to researchers, ThreeAM is part of a nebulous group of ransomware actors with suspected ties to the Lockbit operation.

Analysts at cyber security firm Fortra believe ThreeAM is made up of Russian speakers, and the group may also have ties to the BlackSuit ransomware group.

ThreeAM typically operates using double-extortion techniques, both stealing and threatening to publish data, and also encrypting it in place until a victim pays up.

“All your files are mysteriously encrypted, and the systems ‘show no signs of life’, the backups disappeared,” the group says in its ransom note.

“But we can correct this very quickly and return all your files and operation of the systems to original state.”

The group was first observed in September 2023 and has claimed 85 victims since then. The group’s last Australian victim was ANU Enterprise, which confirmed it was the victim of a ransomware attack in November 2024.