AP

Hacker holds Australian health insurer’s data for ransom

Oct 20, 2022, 12:21 AM | Updated: 3:00 am

People walk past a Medibank branch in Sydney, Thursday, Oct. 20, 2022. Medibank health insurer is b...

People walk past a Medibank branch in Sydney, Thursday, Oct. 20, 2022. Medibank health insurer is being extorted for customers' data in the nation's second major cybersecurity breach in a month, an official says. (AP Photo/Rick Rycroft)

(AP Photo/Rick Rycroft)

CANBERRA, Australia (AP) — A cybercriminal was holding for ransom an Australian health insurer’s customer data including diagnoses and treatments, in the nation’s second major privacy breach in a month, officials said on Thursday.

Trade in Medibank shares has been halted on the Australian Securities Exchange since Wednesday when police were alerted that the company had been contacted by what it described as a “criminal” who wanted to negotiate over the stolen personal data of customers.

Medibank, which has 3.7 million customers, said on Thursday the criminal had provided a sample of 100 customer policies from a purported haul of 200 gigabytes of stolen data.

Details included customer names, addresses, birth dates, national health care identification numbers and phone numbers.

Cybersecurity Minister Clare O’Neil said most concerning was that records of medical diagnoses and procedures had also been stolen.

“Financial crime is a terrible thing. But ultimately, a credit card can be replaced,” O’Neil told reporters.

“The threat that is being made here to make the private, personal health information of Australians made available to the public is a dog act,” she added.

The thief had threatened to sell Medibank data to third parties and singled out records of 1,000 politicians, media personalities, actors, LGBTQ activists and drug addicts for exposure, Nine Network News reported.

“We found people with very interesting diagnoses,” the thief reportedly wrote to Medibank.

Medibank declined to comment on the reported threats and would not release details beyond its statement to the Australian Securities Exchange.

The Medibank breach came a month after a cyberattack stole from telecommunications company Optus the personal data of 9.8 million customers.

The Optus breach, which compromised the personal data of more than one-third of Australia’s population, prompted the government to propose urgent reforms to privacy laws that would increase penalties for companies that fail to protect customers’ data and limit the quantity of data that can be retained.

O’Neil said cybercrime was a growing problem around the world and that Australia needed to be better prepared.

“We are going to be under relentless cyberattack essentially from here on in, and what it means is that we need to do a lot better as a country to make sure that we are doing everything we can within organizations to protect customer data and also for citizens to be doing everything that they can,” O’Neil said.

“Combined with Optus, this is a huge wake-up call for the country and certainly gives the government a really clear mandate to do some things that frankly probably should have been done five years ago, but I think are still very crucially important,” she added, referring to privacy law reforms that the government hopes to pass through Parliament this year.

O’Neil described the Medibank breach as a “ransomware attack,” which the government defines as an attack with malware that locks or encrypts files so that the owner can no longer access them.

O’Neil’s office later said she misspoke and meant that the culprit had demanded ransom.

Medibank said its systems had not been encrypted by ransomware and its usual customer activities continued.

Medibank chief executive David Koczkar said his company was working with specialized cybersecurity firms as well as police and government experts in response to the breach.

“I unreservedly apologise for this crime which has been perpetrated against our customers, our people and the broader community,” Koczkar said in a statement.

“I know that many will be disappointed with Medibank and I acknowledge that disappointment,” he added.

Copyright © The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

AP

Colorado River settlement center of new Navajo Nation push...

Associated Press

Tribes say their future is at stake as they push for Congress to consider Colorado River settlement

Navajo officials are celebrating the signing of legislation outlining a proposed Colorado River settlement that would ensure water rights.

1 day ago

Arizona doctors California abortions...

Associated Press

Arizona doctors can come to California to perform abortions under new law signed by Gov. Newsom

Arizona doctors can temporarily come to California to perform abortions for their patients under a new law signed by Gov. Gavin Newsom.

2 days ago

Father convicted of first-degree murder in northern Arizona...

Associated Press

Arizona man convicted of first-degree murder in starvation death of 6-year-old son

A northern Arizona father was convicted of first-degree murder Thursday in the 2020 starvation death of his 6-year-old son.

2 days ago

Former President Donald Trump sits in a courtroom next to his lawyer Todd Blanche before the start ...

Associated Press

Trump hush money trial enters new phase after defense rests without testimony from former president

Donald Trump's hush money trial is now closer to the moment when the jury will begin deciding the former president's fate.

4 days ago

UoA student convicted of first-degree murder after killing professor...

Associated Press

Former Arizona grad student convicted of first-degree murder in 2022 shooting of professor

A former University of Arizona grad student was convicted of first-degree murder after fatally shooting a professor on campus two years ago.

4 days ago

Rudy Giuliani bankruptcy filing defamation lawsuit...

Associated Press

Ex-NYC Mayor Rudy Giuliani, Arizona’s Kelli Ward plead not guilty in fake elector case

Giuliani appeared remotely for the arraignment that was held in a Phoenix courtroom. His trial will take place in October.

5 days ago

Sponsored Articles

...

Sanderson Ford

3 new rides for 3 new road trips in Arizona

It's time for the Sanderson Ford Memorial Day sale with the Mighty Fine 69 Anniversary, as Sanderson Ford turned 69 years old in May.

...

Collins Comfort Masters

Here’s how to be worry-free when your A/C goes out in the middle of summer

PHOENIX -- As Arizona approaches another hot summer, Phoenix residents are likely to spend more time indoors.

...

COLLINS COMFORT MASTERS

Here are 5 things Arizona residents need to know about their HVAC system

It's warming back up in the Valley, which means it's time to think about your air conditioning system's preparedness for summer.

Hacker holds Australian health insurer’s data for ransom