INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Medibank Data Breach Exposes Sensitive Customer Information

| 2024-11-20 06:29 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 13, 2022, Medibank announced a potential cyberattack after detecting suspicious activity on its network. The Australian company had taken immediate steps to contain the incident and engaged specialized cybersecurity firms. As of that date, there was no evidence that any sensitive data, including customer data, had been accessed. Around 2.8 million customers received an email announcing the incident, stating that no customer data compromise had been detected. However, on October 17, Medibank confirmed that its investigation efforts still hadn't found evidence of customer data being compromised. The company's systems were not encrypted by ransomware during this incident and additional security measures have since been put in place across their network to mitigate the risk.
Technical Mitigations AI-generated
• Isolate and remove access to customer-facing systems, such as ahm and international student policy management systems. • Implement additional security measures across the network, including those recommended by external cybersecurity experts. • Use a technique to detect ransomware threats, such as monitoring for suspicious activity in IT networks.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
cy•••••.au
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
REvilREvil
Target & Sectors
FIVE_EYES FIVE_EYES healthhealth
Incident Timeline
‎October 2022
Threat actors published a segment of the stolen Medibank customer database on the dark web, followed by contact with Medibank to provide proof of data compromise.
data_breach 100 stolen customer records
" - Medibank update published at 11 am, Thursday, 13 October 2022 October 19 - Hackers contact Medibank The hackers contact Medibank and provide a sample of 100 stolen customer records to prove that customer data was indeed compromised.
data_breach 20 MB
The other was "students.7z" and was 20 MB compressed.
data_breach 200 identifiable records
Approximately 200 fully identifiable records were posted.
data_breach 224 MB
One file was named "oscar.7z" and was 224 MB compressed.
data_breach 414 files
After unzipping them, oscar.7z and students.7z contained 414 and 205 files, respectively.
‎2024/11/20
Threat actors accessed and obtained sensitive personal data, including health claims information, of approximately 9.7 million Medibank customers through a ransomware attack that was intercepted before the hackers could encrypt their files.
data_breach 1,000 further ahm policy records
We have been able to determine that this includes: - A copy of the file received last week containing 100 ahm policy records – including personal and health claims data - A file of a further 1,000 ahm policy records – including personal and health c…
infrastructure 9.7
…bstantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Breach Medibank announces that 9.7 million customers were likely impacted in…
victims 9.7 Customers
As a result, we expect that the number of affected customers could grow substantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Bre…
Based on our investigation to date into this cybercrime we currently believe the criminal has accessed: - Name, date of birth, address, phone number and email address for around 9.7 million current and former customers and some of their authorised r…
victims 5.1 Medibank customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
victims 2.8 ahm customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
data_breach 1.8 customers Medicare numbers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
victims 160,000 Medibank customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
victims 20,000 international customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
Tactical Metrics
Metrics
data_breach
1,000
Further Ahm Policy Records
We have been able to determine that this includes: - A copy of the file received last week containing 100 ahm policy records – including personal and health claims data - A file of a further 1,000 ahm policy records – including personal and health c…
Metrics
infrastructure
​9.7
Software Version
…bstantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Breach Medibank announces that 9.7 million customers were likely impacted in…
Metrics
victims
9,700,000
Customers
As a result, we expect that the number of affected customers could grow substantially. -  Medibank cyber attack update published at 9:30am, Wednesday 26 October November 7 - Medibank Announces that 9.7 Million Customers were Impacted in the Data Bre…
Based on our investigation to date into this cybercrime we currently believe the criminal has accessed: - Name, date of birth, address, phone number and email address for around 9.7 million current and former customers and some of their authorised r…
Metrics
data_breach
100
Stolen Customer Records
" - Medibank update published at 11 am, Thursday, 13 October 2022 October 19 - Hackers contact Medibank The hackers contact Medibank and provide a sample of 100 stolen customer records to prove that customer data was indeed compromised.
Metrics
data_breach
20
Mb
The other was "students.7z" and was 20 MB compressed.
Metrics
victims
5,100,000
Medibank Customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
Metrics
victims
2,800,000
Ahm Customers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
Metrics
data_breach
1,800,000
Customers Medicare Numbers
This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers - Medicare numbers (but not expiry dates) for ahm customers - Passport numbers (but not expiry dates) and v…
Metrics
victims
160,000
Medibank Customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
Metrics
victims
20,000
International Customers
…es) for ahm customers - Passport numbers (but not expiry dates) and visa details for international student customers  -Health claims data for around 160,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers.
Metrics
data_breach
200
Identifiable Records
Approximately 200 fully identifiable records were posted.
Metrics
data_breach
224
Mb
One file was named "oscar.7z" and was 224 MB compressed.
Metrics
data_breach
414
Files
After unzipping them, oscar.7z and students.7z contained 414 and 205 files, respectively.
Intelligence Sources
Upguard 2024-11-20