Thursday, December 1, 2022 - Medibank hackers dump stolen data on the dark web

Medibank Pte Ltd
Source - https://www.bankinfosecurity.com/medibank-hackers-dump-stolen-data-on-dark-web-a-20604?rf=2022-12-02_ENEWS_SUB_BIS__Slot1_ART20604&mkt_tok=MDUxLVpYSS0yMzcAAAGIcpep3PnkdybXNESQGQTm2bWeqzZe_5s6jZn6lIcz4o6olP2lhMZkOG1Q8qT1OWsWsoyaovYR-MtlulveEkDtI6okdiuAv5JN
Where - Australia
Business line - Corporate Services
Copyright © Bank Info Security (www.bankinfosecurity.com) 2022

The Russia-based ransomware gang behind the hack of Australia's largest private health insurer says it posted a full set of stolen data even as analysis by Medibank called the data incomplete and difficult to understand.

Hackers posted raw Medibank data in six zipped files of more than 5 gigabytes in a folder called "full."

In a statement, Medibank said that health claims data has not been joined with name and contact details.

The October hack has affected 9.7 million current and former customers, including 1.8 million foreigners residing in Australia.

The ransomware gang behind the hack began leaking information after Medibank CEO David Koczkar declined on principle to negotiate with the hackers.

An investigation by Australian Federal Police is ongoing and there are currently no signs that hackers stole financial or banking data.

Cybersecurity Minister Claire O'Neil released a joint statement with Attorney-General Mark Dreyfus calling the data dump an anticipated development. "The release of such sensitive and personal data is morally reprehensible," they said.

The Australian Information Commissioner announced it had initiated a separate investigation into the personal information handling practices of Medibank.

The primary focus of the investigation will be on whether Medibank took reasonable steps to protect the personal information it held.

If the OAIC privacy commissioner finds "serious and/or repeated interferences with privacy," Medibank could face fines up to AU$2.2 million for each violation.

The Australian Parliament on Monday approved legislation increasing the maximum penalties for serious or repeated corporate privacy breaches from the current $AU2.22 million to whichever is the greater of $AU50 million, 30% of adjusted turnover or three time the value of any corporate benefit obtained through the misuse of information.