Medibank Private has confirmed this morning that stolen customer data is now published online.
“Medibank has today become aware that the criminal has released files on a dark web forum containing customer data that is believed to have been stolen from Medibank’s systems,” said a media release from the private health insurer.
The announcement follows earlier media reports that a ransomware group had started releasing client data after a midnight deadline passed for Australia's largest health insurer to pay a ransom.
Medibank said the data includes names, addresses, dates of birth, phone numbers, email addresses, Medicare numbers for ahm customers, some international students’ passport numbers and some health claims data.
The gang that leaked the stolen data is believed to be a rebrand of the defunct, Russian-speaking REvil group, according to a TechCrunch report.
TechCrunch reported seeing a new dark web leak site listing Medibank as one of the gang’s victims. It did not, however, reveal how much data it exfiltrated from Medibank’s network, and did not share evidence of its claims.
Medibank first announced the cyberattack on October 12. The health insurer later revealed that criminals accessed personal information from more than nine million current and former customers and some of their authorised representatives.
On November 7, the health insurer said it would not pay a ransom. Medibank also issued a warning to customers, stating “criminals could also attempt to contact [them] directly”.
The insurer said it is working with the Australian government, including the Australian Cyber Security Centre and the Australian Federal Police, to investigate the cybercrime.
