Cyber Security Incident Notice

Subject: Cyber Security Incident – Notification to Our Customers

We wish to inform you of a cyber security incident which impacted Friendly Care Management Pty Ltd (FCM), the management company that supports the FriendlyCare Pharmacy group (the Incident).

The Incident was thoroughly investigated with the assistance of our forensics experts and cybersecurity advisors.

These investigations are now concluded, and they have found no FriendlyCare Pharmacy systems were affected.

However, there was unauthorised access to FCM’s IT environment by a malicious actor, including certain files containing personal information relating to our customers. We provide specific details about how this Incident impacted customer information below.

We understand this may cause concern, and we have provided below as much information as we can about the Incident and the investigation findings, as well as details of what you can do.

What happened?

On Wednesday, 15 April 2026, we identified suspicious activity within the FCM IT network and immediately commenced an investigation.

As a result of this activity, information stored within FCM’s IT system was accessed and removed without authorisation by an unknown third-party malicious actor.

Importantly, we quickly confirmed the Incident was contained and the malicious actor was no longer present in our IT environment.

How did we respond to the incident?

We took this Incident very seriously.

Working with our forensics experts and cybersecurity advisors, we undertook a comprehensive investigation to determine the specific details of the Incident.

We notified the Office of the Australian Information Commissioner in relation to the data breach involved with this Incident and have responded to their requests for further information.

We also engaged with relevant Australian Government agencies and cooperated with officials to respond to this criminal activity.

We have communicated regularly through updates on our website to be as transparent as we can be.

We also obtained an injunction from the Supreme Court of New South Wales to prevent any further access to, or unauthorised use or disclosure of, the information affected by the Incident.

Investigation update

The investigation into the Incident is now complete and we can confirm:

there was unauthorised access to FCM’s IT environment from 18 March 2026 to 15 April 2026 (Period of Unauthorised Access); and

during the Period of Unauthorised Access, certain files in our IT environment were accessed by the malicious actor – the types of personal information impacted is detailed below; however

there is no evidence of any personal information being misused by the malicious actor.

Given the malicious actor gained unauthorised access to our IT environment and extracted certain files, it is reasonable to conclude that they had the intention of causing harm to individuals to whom the personal information contained in those files relates.

Based on the investigation findings, we undertook with the support of data forensic specialists a comprehensive data review of the files so that our customers could be informed precisely how this Incident has impacted their personal information.

We understand that learning your personal information may have been compromised can be distressing, and we want to reassure you that we have taken every necessary step to protect your personal information including obtaining the injunction.

We regret any concern this communication may cause and we are committed to protecting your privacy going forward.

Personal information impacted

We have written directly to customers that we hold current contact details for that have been impacted by this Incident.

For customers we have unfortunately been unable to contact directly, this notification details how the Incident may have impacted them.

Following completion of the data review, we have identified that the following types of personal information could have been accessed by the malicious actor:

Full name
Address
Phone number
Email address
Date of birth
Tax File Number (TFN)
Medicare card number
Passport number
Passport scan
Centrelink details
Individual Healthcare Identifier (IHI)
Personal bank account details
Credit card details
Payslip information
Prescription information
Medical records
Birth certificate

We note that not all of the above types of personal information will be impacted for all customers.

What can you do?

While we have no evidence of any personal information being misused by the malicious actor responsible for this Incident or any other unknown third-party, we strongly encourage you to be alert for any suspicious activity.

Nonetheless, you should always be vigilant when it comes to your personal information by taking the following precautionary steps:

Monitor your accounts: Regularly check your financial and online accounts for unusual activity.

Be vigilant for scams: Be cautious of unexpected emails, texts, or calls. Do not click on suspicious links or share personal information.

Reset your passwords: Use strong, unique passwords for each account. Avoid reusing passwords across services.

Enable Multi-Factor Authentication (MFA): MFA adds an extra layer of security and should be enabled wherever possible.

Visit IDCARE: For personalised support and further guidance, visit https://www.idcare.org/.

Review Scamwatch and ACSC resources: For advice on protecting yourself online, visit https://www.scamwatch.gov.au/ and https://www.cyber.gov.au/.

Report suspicious or threatening behaviour immediately: If you believe you are being targeted or harassed as a result of this incident, or if you feel your safety may be at risk, contact Triple Zero (000) immediately for emergency assistance. For non-urgent matters, you may also contact your local police station or report cybercrime via https://www.cyber.gov.au/report.

More information and further updates

If you believe this Incident has impacted you and you would like any further information, please email contact@friendlycare.com.au and we will respond as soon as we can.

Please also visit www.friendlycare.com.au for more information.

Thank you for your understanding and support at this time.

Sincerely,

Matthew Mayne

Managing Director

Friendly Care Management Pty Ltd

28/07/2026