INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Medibank Data Breach Exposed Through Spear-Phishing Attack

| 2024-11-20 06:29 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 13, 2022, Medibank announced a potential cyberattack after detecting suspicious activity on its network. The Australian company had taken immediate steps to contain the incident and engaged specialized cybersecurity firms. As of then, there was no evidence that any sensitive data, including customer data, had been accessed. Around 2.8 million customers received an email announcing the incident, stating that no customer data compromise had been detected. However, further investigation revealed that the unusual activity was consistent with a possible ransomware threat. To mitigate this risk, Medibank put in place additional security measures across its network and continued to work with external cybersecurity experts and the Australian Government's lead cyber agency on its forensic investigation.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
cy•••••.au
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
REvilREvil
Target & Sectors
NORTH_AMERICA NORTH_AMERICA healthhealth
Incident Timeline
‎October 2022
Threat actors published a segment of the stolen Medibank database on the dark web, containing personal information for approximately 200 fully identifiable customers.
data_breach 100 stolen customer records
" - Medibank update published at 11 am, Thursday, 13 October 2022 October 19 - Hackers contact Medibank The hackers contact Medibank and provide a sample of 100 stolen customer records to prove that customer data was indeed compromised.
data_breach 20 MB
The other was "students.7z" and was 20 MB compressed.
data_breach 200 identifiable records
Approximately 200 fully identifiable records were posted.
data_breach 224 MB
One file was named "oscar.7z" and was 224 MB compressed.
data_breach 414 files
After unzipping them, oscar.7z and students.7z contained 414 and 205 files, respectively.
‎2024/11/20
Threat actors accessed and exploited Medibank's systems to obtain sensitive customer data, including personal details, health claims information, and Medicare numbers.
data_breach 1,000 further ahm policy records
We have been able to determine that this includes: - A copy of the file received last week containing 100 ahm policy records – including personal and health claims data - A file of a further 1,000 ahm policy records – including personal and health c…
infrastructure 9.7
…bstantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Breach Medibank announces that 9.7 million customers were likely impacted in…
victims 9.7 Customers
As a result, we expect that the number of affected customers could grow substantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Bre…
Based on our investigation to date into this cybercrime we currently believe the criminal has accessed: - Name, date of birth, address, phone number and email address for around 9.7 million current and former customers and some of their authorised r…
victims 5.1 Medibank customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
victims 2.8 ahm customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
data_breach 1.8 customers Medicare numbers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
victims 160,000 Medibank customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
victims 20,000 international customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
Tactical Metrics
Metrics
data_breach
1,000
Further Ahm Policy Records
We have been able to determine that this includes: - A copy of the file received last week containing 100 ahm policy records – including personal and health claims data - A file of a further 1,000 ahm policy records – including personal and health c…
Metrics
infrastructure
‎9.7
Software Version
…bstantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Breach Medibank announces that 9.7 million customers were likely impacted in…
Metrics
victims
9,700,000
Customers
As a result, we expect that the number of affected customers could grow substantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Bre…
Based on our investigation to date into this cybercrime we currently believe the criminal has accessed: - Name, date of birth, address, phone number and email address for around 9.7 million current and former customers and some of their authorised r…
Metrics
data_breach
100
Stolen Customer Records
" - Medibank update published at 11 am, Thursday, 13 October 2022 October 19 - Hackers contact Medibank The hackers contact Medibank and provide a sample of 100 stolen customer records to prove that customer data was indeed compromised.
Metrics
data_breach
20
Mb
The other was "students.7z" and was 20 MB compressed.
Metrics
victims
5,100,000
Medibank Customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
Metrics
victims
2,800,000
Ahm Customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
Metrics
data_breach
1,800,000
Customers Medicare Numbers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
Metrics
victims
160,000
Medibank Customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
Metrics
victims
20,000
International Customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
Metrics
data_breach
200
Identifiable Records
Approximately 200 fully identifiable records were posted.
Metrics
data_breach
224
Mb
One file was named "oscar.7z" and was 224 MB compressed.
Metrics
data_breach
414
Files
After unzipping them, oscar.7z and students.7z contained 414 and 205 files, respectively.
Intelligence Sources
Upguard 2024-11-20