Medibank confirmed that the threat actors behind the cyber-attack have posted another dump of data stolen from its systems on the dark web after they refused to pay a ransom.
The cybercriminals behind the Medibank cyber-attack have posted on the dark web what appears to be the remainder of the customer data they took from the health insurer, stating it is “case closed” for the hack.
Medibank said it is in the process of analyzing the data but it “appears to be the data we believed the criminal stole”.
According to a spokesperson, as the investigation continues there are currently no signs that financial or banking data has been taken. The personal data stolen, in itself, is not sufficient to enable identify and financial fraud. The raw data that was analyzed so far is incomplete and hard to understand.
The leak comes almost a month after the company acknowledged that personal data belonging to around 9.7 million of its current and former customers were accessed following a ransomware incident in October 2022.
This includes 5.1 million Medibank customers, 2.8 million ahm customers, and 1.8 million international customers. Also accessed were health claims for about 160,000 Medibank customers, 300,000 ahm customers, and 20,000 international customers.
It is the first drop from the hackers in over a week, and the sixth overall since Medibank refused to pay a US$10m (AU$15m) ransom.
The latest dataset, which has been uploaded in the form of six ZIP archive files, includes health claim information, although Medibank noted much of the data is fragmented and that it’s not combined with customer names and contact details.
The Australian federal police said the group are located in Russia and are believed to be connected to the REvil ransomware group.
Medibank’s personal information handling practices will now be investigated by the Office of the Australian Information Commissioner.
Comments