A Brisbane medical practice serving thousands of veterans lost Department of Veterans' Affairs ID numbers from a single email mailbox after a phishing attack — and then took twelve weeks to tell the patients. We walk the confirmed timeline (mailbox accessed in April, discovered 24 April with same-day containment and user alerts, OAIC notified 18 May, patients notified 16 July, ABC story 21 July), what GO2 Health has confirmed was taken, and what remains genuinely unknown — including the number of people affected, which the practice has not published. The lessons transfer to any Australian business: shared mailboxes are undesigned databases holding data your secured systems never see; auto-archiving capped this breach at twelve months and is the cheapest blast-radius control there is; the 30-day OAIC assessment clock governs telling the regulator, ...