Ransomware gang threatens to publish stolen Medibank data

TechCrunch reported seeing a new dark web leak site listing Medibank as one of the gang’s victims. It did not, however, reveal how much data it exfiltrated from Medibank’s network, and did not share evidence of its claims.

Medibank first announced the cyberattack on October 12. The health insurer has since revealed that criminals have accessed the name, date of birth, address, phone number and email address of around 9.7 million current and former customers and some of their authorised representatives.

Following media reports that criminals have now threatened to publish the stolen data – after the announcement on November 7, when the insurer said it will not pay a ransom – Medibank has issued a warning to customers, stating “criminals could also attempt to contact [them] directly”.

The insurer said it is working with the Australian Government, including the Australian Cyber Security Centre and the Australian Federal Police, to investigate the cybercrime and try to prevent the sharing and sale of Medibank customers’ data.

Medibank issued the following advice for customers:

If you are contacted by someone who claims to have your data, or you are a victim of cybercrime, you can report it at ReportCyber on the Australian Cyber Security Centre website;
To report a scam, go to ScamWatch;
If you believe you are at physical risk, please call emergency services (000) immediately; and
Customers can also contact us via our contact centre team (13 23 31 for Medibank and international customers, 13 42 46 for ahm customers and 1800 081 245 for My Home Hospital patients).

The insurer also shared a list of cybersecurity tips for customers:

Be alert for any phishing scams via phone, post or email;
Verify any communications received to ensure they are legitimate;
Do not open texts from unknown or suspicious numbers; and
Change passwords regularly with ‘strong’ passwords, and use multi-factor authentications on any online accounts where available.

The insurer said it will never contact customers asking for password or sensitive information. It also “unreservedly apologise[d]” to its customers.