Millions of Medibank’s current and former customers have had their personal information, including health claims, exposed in a hack of the company’s customer database.
Here’s what we know so far, and what you can do.
Am I affected?
If you are a customer of Medibank or its subsidiary ahm, or are an international student with Medibank, or you have been a customer in the last seven years or longer, it’s likely your data has been exposed in the breach.
The company has said 9.7 million customers in total are exposed. That includes 5.1 million Medibank customers, 2.8 million ahm customers and 1.8 million international customers.
If you are a current or former customer of Medibank you’ve likely already received an email advising you about the hack itself. Medibank has also sent follow-up emails to customers whose data was included in a sample of records received from the hacker.
Late in October, the company said the hacker had access to all customer accounts, but could not say how many people actually had their data taken.
Medibank has also said former customers have been included in the records received so far, as the company is legally required to keep information for seven years after a person stops being a Medibank customer.
What personal information has been compromised?
Medibank has determined the hacker was able to obtain the following information for all customers, including Medibank, ahm and international student customers:
Name
Address
Date of birth
Gender
Email address
Medicare card number (in some cases)
Health claims made with Medibank (in some cases)
Of these, the date of birth, address, Medicare card numbers and health claims would be of most concern for potential identity theft or extortion attempts.
The health insurer said the hackers obtained claims for about 160,000 Medibank customers, 300,000 ahm customers and 20,000 international customers. The exposed information included service provider names and codes associated with diagnosis and procedures.
What can I do about personal identification information being exposed?
Similar to the response to the Optus data breach, experts suggest not rushing out and changing everything. People should always seek to use strong passwords and multifactor authentication on their online accounts – not just with Medibank.
They can also advise their bank and other financial institutions to put in place additional security checks for their accounts (particularly for over-the-phone transactions).
For compromised Medicare numbers, Medibank has not yet advised how many or which customers are affected.
What can I do about my personal medical information being breached?
Unfortunately, at this stage, not a lot.
After Medibank refused to pay the ransom, the hackers began posting some of the records on a blog on the dark web.
So far claims associated with alcohol and drug use, mental health, and terminating pregnancies have been released, along with hundreds of others. Medibank has said they have alerted those who have had their records posted on the dark web, and will be providing them direct support.
What will Medibank do for affected customers?
There will be a support package for affected customers, including:
Financial support for customers who “are in a uniquely vulnerable position” as a result of the hack, who will be supported on an individual basis.
Access to Medibank’s health and wellbeing support line.
Specialist ID protection services from IDCARE.
Identity monitoring services for customers who have had their primary ID compromised.
Reimbursement of fees for reissue of ID documents that were “fully compromised” in the hack.
Is the government doing anything?
Federal government agencies including the Australian federal police are investigating the hack.
Commissioner Reece Kershaw announced that through the investigation the AFP had determined the hackers were located in Russia, and were believed to be associated with known hacker groups. The AFP has identified individuals involved, and Kershaw said the AFP would be seeking the support of Russian authorities to continue the investigation.
The home affairs minister, Clare O’Neil, has been in frequent contact with Medibank, and the National Coordination Mechanism was established to bring state and federal departments and agencies together on the breach along with Medicare. The mechanism has met eight times so far.
The government also introduced legislation into parliament last month changing privacy law to impose harsher penalties of up to $50m for serious or repeated data breaches.
