Medibank customer details were obtained in hack

Medibank said in the light of the latest developments it will begin contacting current and former customers to recommend steps they could take.

“We will also begin contacting customers whose data we now know has been compromised,” the company said.

It urged customers to remain vigilant to suspicious communications received via email, text or phone call.

The news comes nearly two weeks after the hacking incident, which was initially played down by Medibank when it said on October 14 that there was no evidence that customer data was accessed.

This changed last week when Medibank received the hackers’ threat – which was also received by The Sydney Morning Herald and The Age. The unknown group said they would sell 200 gigabytes of stolen data unless Medibank paid a ransom. It contains a threat from the hackers to first target 1000 high-profile Australians with their own data as a warning.

The shadow minister for cyber security, Senator James Paterson, criticised the government for a slow response to the attacks, noting that despite the company’s initial denials, customers’ worst fears have now been realised.

“After a slow and confused response to the Optus cyber attack, it is concerning that it took the Cyber Security Minister Clare O’Neil a week to publicly respond to the Medibank hack,” he said.

“Ms O’Neil should explain why she accepted the company’s initial denial [that] this was serious, delaying government engagement by a week. Every day lost worsens the damage done.”

Medibank has a total customer base of close to 4 million customers.

Logs obtained by cybersecurity researchers and seen by The Sydney Morning Herald and The Age indicate someone with access to internal Medibank systems had their company login credentials stolen from their web browser. The credentials were stolen some time around August 7.

Loading

Current investigations have confirmed that these details were then sold online to the party who accessed Medibank’s systems and copied the health records by deploying a tool on the platform to harvest customer data at a large scale.

Medibank does not believe the hacker is state-sponsored, but no further details of their origins are known.

Shares of the $10 billion company have been suspended from trading since last week, but are due to come out of its suspension on Wednesday morning. Medibank flagged it expects to make a further announcement before then.