Medibank has revealed that a cyber attack on its customer data was much more serious than originally thought.
The private health provider confirmed on Tuesday morning that data from customers of its main brand, Medibank, was compromised, as well as those from its budget ahm brand, and international student customers.
“This is a distressing development and Medibank unreservedly apologises to our customers,” the healthcare provider said in a statement.
It said it was assisting an Australian Federal Police investigation into the breach and expected the number of its customers affected – previously estimated to be at least four million – to grow.
The alleged hackers claim they have stolen 200 gigabytes of data that includes medical history, including where medical services were received and codes relating to their diagnosis and procedures.
Medibank said alleged hackers had so far sent it:
- A copy of a file containing 100 ahm policy records – including personal and health claims data.
- A file of a further 1000 ahm policy records – including personal and health claims data.
- Files containing some Medibank and additional ahm and international student customer data.
“Given the complexity of what we have received, it is too soon to determine the full extent of the customer data that has been stolen,” the company said.
The Medibank hack follows a major breach at telecommunications company Optus last month, in which almost 10 million customers had their personal data stolen in a massive hack.
Medibank said it would continue to analyse the files received to understand the “total number of customers impacted, and specifically which information has been stolen”.
Medibank CEO David Koczkar “unreservedly” apologised to customers who had been the victims of “this serious crime”.
“As we continue to uncover the breadth and gravity of this crime, we recognise that these developments will be distressing for our customers, our people and the community – as it is to me,” he said in a statement.
“This is a malicious attack that has been committed by criminals with a view of causing maximum fear and damage, especially to the most vulnerable members of our community.”
Medibank has announced a customer support package including: 24/7 mental health and wellbeing support; support for customers who are in uniquely vulnerable positions; access to specialist identity protection advice with IDCARE for all customers.
The insurer will also defer premium increases for Medibank and ahm customers until January 16, 2023.
Medibank customers concerned they are affected by the breach can call 132 331
Customers concerned for their mental wellbeing can speak to qualified Medicare mental health professionals on a 24/7 phone line: 1800 644 325
