Medibank customer data related to claims for mental health treatment are the latest to be posted on the dark web by the Russian hacker group.
On Sunday night the group posted a file on its dark web blog labelled “psychos”, which contains hundreds of claims from policyholders that appear to be related to mental health treatment.
The group said “we always keep our word” and added they would not have posted the data if a ransom was paid.
“We never lies [sic] – it doesn’t make sense, if we lie to somebody – nobody will treat us as a serious business side [sic].”
The daily drip of leaked customer records may come to a halt for the week, however, with the group posting it would not publish another portion of the data until Friday “in a hope something meaningful happened [sic] on Wednesday”.
Medibank is due to hold its annual general meeting on Wednesday.
The federal government announced on Saturday the establishment of a permanent joint standing operation made up of 100 members of the Australian federal police and Australian Signals Directorate to target hacker groups.
“They will show up to work every day with the goal of bringing down these gangs and thugs,” the home affairs minister, Clare O’Neil, said.
“This is the formalisation of a partnership, a standing body in the Australian government, which will day in, day out, hunt down the scumbags who are responsible for these malicious crimes against innocent people.”
The Australian federal police commissioner, Reece Kershaw, said on Friday that the group is believed to be based in Russia, and called on Russia to cooperate with law enforcement investigations.
The Russian embassy in Canberra said the statement had been made before AFP had contacted Russia.
“We encourage the AFP to duly get in touch with the respective Russian law enforcement agencies,” the embassy posted on Facebook.
“Fighting cybercrime that adversely affects people’s lives and damages businesses demands a cooperative, non-politicized and responsible approach from all members of the world community.”
On Sunday O’Neil said the government would look at whether to make paying ransoms illegal as part of the government’s overall cyber strategy. She said Medibank made the right call in not paying the ransom.
“I have never seen people that lack a moral code so clearly than the hackers who are releasing data about Australians online,” she told ABC’s Insiders program. “The idea we will trust these people to delete data, that they have taken off and may have copied a million times is, frankly, silly.”
The breach covers 9.7 million current and former customers, including 5.1 million Medibank customers, 2.8 million ahm customers and 1.8 million international customers.
The insurer says health claims for about 160,000 Medibank customers, 300,000 ahm customers and 20,000 international customers were accessed. The information exposed includes service provider names and codes associated with diagnosis and procedures.
There were also 5,200 My Home Hospital patients who had their personal and health data accessed, and 2,900 next of kin of these patients who had some contact details accessed.
