Australian insurer Medibank says hackers leaked all of the data they stole in October

Following Australian health insurer Medibank’s refusal to pay a ransom, cybercriminals have dumped a vast trove of personal information of Australian citizens and international students on the dark web.

In October, Australian private health insurance provider Medibank Private suffered a massive cyber attack that forced it to take certain systems offline to protect customers’ information. The ransomware attack reportedly impacted close to ten million current and former customers of the insurance giant.

Though the company managed to isolate its systems after discovering the attack, the attackers had by then successfully exfiltrated the data of around 5.1 million Medibank customers, 2.8 million ahm customers, and 1.8 million international customers.

The compromised details include customers’ names, dates of birth, addresses, phone numbers, email addresses, Medicare numbers (but not expiry dates) for ahm customers, passport numbers, and visa details for international student customers.

After Medibank refused to pay a ransom of USD 10 million demanded by a Russia-based cybercriminal group, the gang leaked a huge tranche of stolen data on the Dark Web. This data set included confidential and sensitive personal and healthcare information of those who availed of Medibank’s services.

According to Australian media, the database uploaded on the Dark Web contained several other files with labels like “good list,” “students” and “naughty list.” It also contains people’s health claims data, medical procedure history, names, addresses, birthdates, and government ID numbers.

On 1st December, Medibank issued another update about the cybersecurity incident, stating that hackers behind the unparallelled data theft had released another huge trove of data on the Dark Web.

"We are aware that stolen Medibank customer data has been released on the dark web overnight. We are in the process of analysing the data, but the data released appears to be the data we believed the criminal stole. Unfortunately, we expected the criminal to continue to release files on the dark web, the company said.