Ransomware Gang Publishes Stolen Genea IVF Patient Data

Sensitive patient data stolen from IVF clinic Genea has been published online by the Termite ransomware group.

The clinic confirmed in a statement on February 26 that data taken from its systems “appears to have been published externally by the threat actor.”

Genea had previously confirmed that highly sensitive patient data had been accessed by the hackers during the incident. This included medical information such as diagnoses and treatments, pathology and diagnostic test results, and notes from doctors and specialists.

Following the publication of the stolen data, Genea obtained a court-ordered injunction to prevent its use, dissemination or publication by the threat actor and/or any third party who receives the stolen data set.

“We understand that this development may be concerning for our patients for which we unreservedly apologise,” the company stated.

Genea patients have been warned to be vigilant of phishing attacks and attempted identity theft.

The clinic is engaging with the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC) in relation to the incident.

Genea first notified patients of the breach on February 19. The firm has multiple clinics across Australia, serving thousands of patients.

Termite Ransomware Group Behind Attack

The Genea data breach appears to have been perpetrated by the Termite ransomware group.

Dark web monitoring firm FalconFeeds reported on X that the gang had added five new victims to data leak site overnight on February 25, providing sample screenshots for each victim.

The other four purported victims were UK-based businesses – two legal firms and two finance companies.

🚨 TERMITE Ransomware Alert 🚨

TERMITE ransomware group has added 5 new victims to their dark web portal.

Rooks Rider Solicitors LLP 🇬🇧
Genea 🇦🇺
National Legal Service Solicitors 🇬🇧
Arc & Co. 🇬🇧
London Belgravia Group 🇬🇧

Note: Sample screenshots are provided on their dark… pic.twitter.com/uzlGLgpp5u

— FalconFeeds.io (@FalconFeedsio) February 25, 2025

Termite has reportedly been active since April 2024. The group claimed to be behind the November 2024 ransomware attack on supply chain management firm Blue Yonder, which impacted the operations of Starbucks and a number of major UK supermarkets.

It has also claimed attacks against organizations in critical sectors, including government agencies, oil and gas and automotive manufacturing.

An analysis by threat intelligence firm Cyble assessed that Termite is essentially a rebranding of the notorious Babuk ransomware.