Medibank Australia – Confidential Details of 9.7 Million Citizens Made Public

The following details were published on the Cyber Security Hub in relation to the Medibank Australia system “data breach” in 2022.

I have reprinted the details here to emphasise the gravity of the event. It is important that you read this, as it highlight the behaviour of the criminal, the company, law enforcement and government.

What Happened?

• 13 October – Medibank notices some unusual activity on its networks. The affected networks are shut down.
• 14 October – the affected networks are restarted. Medibank releases a statement saying that there is “no evidence” that any customer data was accessed during the breach.
• 17 October – Medibank releases an update on the cyber security incident, describing the ongoing investigation into the unusual activity and recognizing that while it was “consistent with the precursors to a ransomware event”, there was still no evidence customer data had been compromised.
• 19 October – Medibank are contacted directly by the hacker, who claims to have stolen 200GB worth of customer data. The hacker attempts to negotiate the release of the information.
• 20 October – Medibank confirms that the hacker’s claims are legitimate. The Australian Federal Police starts investigating the cyber-attack.
• 7 November – the scope of the data breach is revealed, with Medibank confirming that the data of 9.7 million past and present customers was stolen in the breach. Medibank makes a public statement refusing to pay any ransom to the hacker.
• 8 November – the hacker threatens to release files on the dark web and encourages Medibank shareholders to sell their shares.
• 9 November – the hacker releases the “good-list” and “naughty-list” customer data files on the dark web. The Australian Federal Police partners with Commonwealth agencies and the Five Eyes Law Enforcement partners to investigate the cyber crime. Operation Guardian, which was previously introduced to help the victims of the Optus data breach, is extended to those affected by the Medibank data breach.
• 10 November – the hacker releases the “abortions” customer data files on the dark web and demands US$10mn to stop releasing data. 
• 11 November – The AFP, in collaboration with Interpol, linked the gang to a Russian hacking group

Update On Events

• 1 December 2022 – Australian government (OAIC) opens investigation. The investigation will focus on whether Medibank took reasonable steps to protect the personal information they held from misuse, interference, loss, unauthorised access, modification or disclosure.
• 25 January 2023 – Customer and practitioners were individually contacted and informed that Medibank are sorry for the hardship caused.
• 27 June 2023 – Another of Australia’s government departments (APRA), announced it has taken action against health insurer Medibank and that it would impose an increase in Medibank’s capital adequacy requirement to the sum of $250 million. This essentially means Medibank has been ordered to hold an additional $250m as insurance against issues related to its 2022 data breach.
• 22 January 2024 – Aleksandr Gennadievich ERMAKOV is sanctioned by the Australian government as this is the best guess at who was behind the crime. From the information in the document, this is not a prosecution of any kind, nor is there any clue as to whether he was working alone or as part of a larger organisation. He is currently thought to be in Russia.

What We Have Learned?

All of the best law enforcement agencies in this country and internationally with all their mass surveillance on the planet is still unable to find the criminal organisation.

The weakest link to all of the biggest data collection organisations (companies and government departments alike) is the poor employee sitting at the computer terminal. The one who unwittingly “enables” the attacker to log into the system with full access to all data.

Neither the companies that collect this information nor the governments that insist on the collection are held responsible for this horrendous event.

The 9.7 million people who have had their personal details published on the Internet are all left with serious personal and financial issues to deal with. The damage is done and the information is there for life! When you combine the information available on the “dark web”, with data obtained from the Optus data breach also available on the “dark web”, using current AI tools, you end up with comprehensive personal details: including full name, address, bank account numbers, medical records, driver’s licence and passport details.

So in 2024, we have learned nothing from this incident.

Many people that I have spoken to, were not even aware that this had occurred. The mainstream media has long forgotten the issue.

Our governments are continuing on their crusade to add more personal information into central databases and implement easier ways for criminals to attack the public via the Digital ID system.