• Home
  • Internet
  • Internet News
  • Medibank Data Breach: Personal Information of Australian Health Insurer's Customers Posted to the Dark Web

Medibank Data Breach: Personal Information of Australian Health Insurer's Customers Posted to the Dark Web

The release of personal information from Medibank comes after a vast data leak at telecom provider Optus unit in September.

Medibank Data Breach: Personal Information of Australian Health Insurer's Customers Posted to the Dark Web

Photo Credit: Bloomberg

Medibank has said that it expects more data to be released

Highlights
  • Hackers exposed medical information of around 9.7 million people
  • The hackers warned early Tuesday that they would release the data
  • Medibank may have to compensate affected customers for the data breach
Advertisement

Data stolen from an Australian health insurer, including the names, addresses and birthdates of hundreds of customers, has been posted to a forum on the so-called dark web.

The files appear to be a sample of the data that was accessed, Medibank said in a statement Wednesday. The company expects more data to be released, after earlier this week saying the hackers exposed information of around 9.7 million people.

The release of the personal information comes after a vast data leak at Singapore Telecommunications's Optus unit in September, which exposed the details of as many as 10 million customers. Other recent hacks on pathology services provider Australian Clinical Labs and Woolworths subsidiary MyDeal have raised concern Australian companies aren't doing enough to protect customer data.

The hackers warned early Tuesday that they would release the data within 24 hours, a day after the Melbourne-based company said it wouldn't pay a ransom because that would only encourage further crime. The leaked data contained details of about 100 customers including their treatments for cannabis dependence, alcohol abuse, anxiety, and drug use, the Australian Financial Review reported.

Medibank's data breach could cost the company more than $129 million (roughly Rs. 1,050 crore), according to Bloomberg Intelligence analysts Matt Ingram and Jack Baxter. The health insurer, which has already delayed premium increases for affected customers, could face compensation of AUD 500 (roughly Rs. 26,300) to AUD 20,000 (roughly Rs. 1,052,300) for affected policyholders, the analysts said.

Medibank shares rose 0.7 percent in afternoon trading in Sydney Wednesday. The stock has slumped around 20 percent since the hack was first detected just under a month ago, wiping about AUD 2 billion (roughly Rs. 10,500 crore) off the company's market value.

The exposure of the first batch of information and threats to post more could be designed to pressure Medibank to pay the ransom, said Josh Lemon, who teaches cybersecurity at the SANS Institute.

“Unfortunately paying the ransom doesn't always guarantee that the data won't be released, or resold to other cybercriminals,” Lemon said. “I don't believe paying the ransom at this stage will do much more than delay how quickly the data may be released.”

Home Affairs Minister Clare O'Neil said Medibank's decision not to pay a ransom to cyber criminals was in line with government advice.

“Paying them only fuels the ransomware business model,” O'Neil said. “They commit to undertaking actions in return for payment, but so often re-victimize companies and individuals.”

“Under no circumstance should Medibank consider paying the ransom,” said Troy Hunt, who runs breach-tracking website haveibeenpwned. “Their position on this was the right one and reflects the government position on cybercrime and ransoms.”

The Australian Federal Police's operation Guardian, which was initially set up to protect victims of the Optus data breach, will be expanded to include victims of the Medibank hack, Assistant Commissioner Justine Gough said Wednesday.

The government on Wednesday also passed legislation increasing the penalty for repeated or serious privacy breaches to at least AUD 50 million (roughly Rs. 260 crore).

“Significant privacy breaches in recent weeks have shown existing safeguards are outdated and inadequate. This bill makes clear to companies that the penalty for a major data breach can no longer be regarded as the cost of doing business,” said Attorney-General Mark Dreyfus in a statement.

© 2022 Bloomberg L.P.


Are the Pixel 7 and 7 Pro the best in their segment? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated - see our ethics statement for details.
Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: Medibank, Australia, Cybersecurity
Samsung Galaxy A54 5G With 25W Charging Support Spotted on 3C Certification Website: Report
Japan’s Telecom Major NTT Docomo, Accenture Partner to Provide $4 Billion Fund for Web3 Exploration
Facebook Gadgets360 Twitter Share Tweet Snapchat LinkedIn Reddit Comment google-newsGoogle News

Advertisement

Follow Us
© Copyright Red Pixels Ventures Limited 2024. All rights reserved.
Trending Products »
Latest Tech News »