Executive Summary
In October 2022, Medibank Private, Australia’s largest private health insurer, disclosed that an attacker had accessed the personal and health claims data of 9.7 million current and former customers. The attacker subsequently issued a ransom demand for approximately USD $10 million. Medibank declined to pay.
In response to the refusal, the attacker, assessed to be affiliated with the REvil ransomware group, began publishing stolen data on a dark web blog. The published files were specifically selected for maximum personal harm: they included customer lists under headers referencing sensitive conditions, including customers who had sought treatment for addiction, mental health conditions, and other stigmatised diagnoses.
The Medibank incident is the most consequential data breach in Australian history by the metric of individual harm. Unlike financial data breaches where the primary risk is identity theft and financial fraud, the weaponised publication of health claims data caused irreversible privacy harm to individuals who had sought medical care under the expectation of confidentiality. The harm cannot be undone by credit monitoring or identity theft insurance.
The Australian Federal Police, working with international law enforcement, subsequently identified and sanctioned a Russian national assessed to be responsible for the attack.
Incident Overview
Date detected: October 2022
Organisation: Medibank Private Limited (ASX listed; Australia’s largest private health insurer)
Customers affected: 9.7 million current and former customers
Data stolen: Names, dates of birth, addresses, Medicare numbers, passport numbers (for international students), phone numbers, email addresses, and health claims data including diagnosis codes and procedures
Attack vector: Stolen credentials from an Medibank IT contractor, used to access the internal network and ahm (Medibank’s subsidiary) systems
Ransom: Approximately USD $10 million demanded; Medibank declined to pay
Regulatory outcome: Medibank is facing a class action lawsuit and investigation by the Office of the Australian Information Commissioner (OAIC). In 2024 the OAIC found Medibank had breached the Australian Privacy Act.
Attribution: AFP and Australian government attributed the attack to a Russian individual associated with REvil; Australia, the US, and UK imposed targeted financial sanctions
Technical Analysis: What Happened
The initial access was achieved through credentials stolen from a Medibank IT contractor. The contractor’s credentials were available for purchase on a dark web criminal marketplace, having been harvested from the contractor’s personal device by an information-stealing malware (infostealer).
The attacker used the contractor credentials to authenticate to Medibank’s network. Critically, the contractor’s account did not have multi-factor authentication enforced for remote access to Medibank systems. This allowed the attacker to authenticate with the stolen username and password alone.
Once inside Medibank’s network, the attacker moved laterally and gained access to the ahm and Medibank customer databases. The data exfiltration occurred over an extended period without triggering real-time detection sufficient to prevent the full exfiltration of 9.7 million customer records.
The sequence of publication following ransom refusal:
- Medibank confirmed the breach and declined to pay on 26 October 2022
- Attacker began publishing stolen data on 9 November 2022
- Published files were categorised under deliberately harmful labels referencing specific medical conditions
- Publication continued intermittently over subsequent weeks
- The attacker eventually announced the data had been “free released” to a hacking forum
The deliberate targeting of the most stigmatising medical data for publication represents a qualitative shift in the threat model for health insurers: data is not just a commodity to be sold but can be weaponised as a coercion instrument against both the insurer and its policyholders.
ITGC Control Failures
Multi-Factor Authentication for Remote Access: The most direct cause of the breach was a contractor account without MFA that was used for remote access to Medibank’s network. A hardware or software second factor would have prevented the attacker from using the stolen credentials. MFA is a fundamental control for any remote access pathway to a network that holds sensitive personal data.
Third-Party and Contractor Credential Management: The credential compromise originated from the contractor’s personal device, where an infostealer had harvested credentials. Controls that would have reduced this risk include: requiring contractors to use corporate-managed devices or virtual desktop infrastructure (VDI) that does not mix corporate credentials with personal device security, monitoring for contractor credential exposure on dark web marketplaces, and implementing just-in-time access provisioning for contractors rather than standing access.
Data Exfiltration Detection: The exfiltration of records for 9.7 million customers produced a substantial data volume. Detection controls that alert on anomalous data volumes moving from internal systems to external destinations, or that identify bulk database queries outside normal operational patterns, should have detected the exfiltration in progress. The fact that the exfiltration was not detected in time to prevent it indicates gaps in DLP and SIEM monitoring.
Privileged Access Management: Once inside the network, the attacker moved laterally to access customer databases. The extent of lateral movement required to reach 9.7 million customer records suggests that network segmentation and privileged access controls were insufficient to contain the attacker’s access to the specific systems they targeted.
Incident Response Plan for Ransom Refusal Scenarios: Medibank’s decision not to pay was the correct decision aligned with law enforcement guidance. However, the incident response plan must anticipate the adversarial consequences of ransom refusal: if data publication is the likely response, communications plans for affected customers and monitoring for published data must be pre-planned.
The Health Data Harm Model
The Medibank breach illustrates that health data is categorically different from financial data in the harm it causes when exfiltrated and published:
Financial data: Credit card numbers and account details enable financial fraud that is in most cases reversible through fraud claims and card replacement. The harm, while significant, is predominantly financial.
Identity data: Names, addresses, and identity document numbers enable identity theft that can take years to resolve but is ultimately addressable through identity remediation programs.
Health data: Diagnoses, procedures, and health claims records reveal information that individuals have shared with their doctor under the expectation of medical confidentiality. Publication of this data causes reputational, employment, insurance, and personal harm that is irreversible. A person whose treatment for a mental health condition, addiction, or sexually transmitted infection is published online cannot un-publish it.
The Medibank attacker understood this asymmetry and exploited it explicitly: by selecting the most stigmatising data for initial publication, they were attempting to maximise the pressure on Medibank and on individual customers to force payment. The customers whose data was published did not receive any of the ransom, and their harm was not reduced by Medibank’s refusal to pay.
This harm model has implications for how health insurers and healthcare providers should think about data security investment: the consequences of a breach are not just financial and regulatory but extend to irreversible harm to individuals that cannot be compensated.
Regulatory and Legal Consequences
The OAIC’s investigation found that Medibank’s privacy practices did not meet the standard required by the Australian Privacy Act. Specifically, the OAIC found that Medibank failed to take reasonable steps to protect personal information from misuse and unauthorised disclosure.
The class action litigation against Medibank, filed on behalf of affected customers, seeks compensation for the breach, including for the distress caused by the publication of sensitive health data.
The Australian government amended the Privacy Act following the Medibank and Optus breaches of 2022, increasing maximum penalties for serious or repeated privacy interference from AUD $2.2 million to the greater of AUD $50 million, three times the value of any benefit obtained, or 30 percent of the entity’s adjusted turnover in the relevant period.
Lessons and Recommendations
Enforce MFA universally, including for contractor and third-party remote access. The Medibank breach was enabled by a contractor account without MFA. There is no access pathway to a network holding sensitive personal data that should be exempt from MFA. Contractor and third-party access to production systems must be subject to the same MFA standards as employee access.
Monitor dark web markets for corporate credential exposure. The credentials used to access Medibank’s network were available on dark web criminal marketplaces before the attack. Commercial services that monitor for the appearance of corporate domain credentials on these marketplaces provide early warning that can enable credential rotation and account lockdown before the credentials are used.
Implement DLP controls calibrated for bulk health data exfiltration. Exfiltrating records for 9.7 million customers produces a characteristic data volume signature. DLP rules calibrated to the expected volume of normal health data transfers should flag and block bulk exfiltration attempts.
Develop a ransom refusal incident response plan. The operational and communications consequences of refusing to pay are predictable: data publication, customer notification requirements, and sustained media attention. Prepare for this scenario before it occurs, not after the attacker has begun publishing.
Treat health data retention as a security control. Every year of health claims data retained is another year of potential harm if exfiltrated. Retention policies that limit claims data to the minimum period required for regulatory and operational purposes reduce the scope of any future breach.
Assessment Framework for Health Insurers
The ITGC controls most directly implicated in this incident map to the following audit testing areas:
- MFA enforcement for all remote access pathways, including contractor and third-party access
- Contractor device management and credential isolation controls
- Data exfiltration monitoring and DLP configuration for bulk health data transfers
- Dark web credential monitoring and alerting programs
- Privacy Act compliance assessment and data retention policy review
Open the ITGC Audit Tool
