The Australian federal police say hackers in Russia are responsible for the Medibank data breach, with the commissioner stating “we know who you are”.
Reece Kershaw said on Friday that the AFP had identified the hackers while working with Interpol.
“Our intelligence points to a group of loosely affiliated cybercriminals who are likely responsible for past significant breaches in countries across the world,” Kershaw said.
“These cybercriminals are operating like a business, with affiliates and associates who are supporting the business.”
The commissioner said some of those involved could be in countries other than Russia but the AFP would be talking with Russian law enforcement about the individuals it had identified.
Kershaw said Russia was accountable to Interpol, given it benefited from intelligence sharing. He said the AFP was also “scouring the internet and dark web” to find people seeking to profit from the Medibank hack.
“To the criminals – we know who you are and, moreover, the AFP has some significant runs on the scoreboard when it comes to bringing overseas offenders back to Australia to face the justice system,” Kershaw said.
The Russian embassy in Australia said in a statement on Friday night that Kershaw should have contacted them before going public with his comments.
“For some reason, this announcement was made before the AFP even contacted the Russian side through the existing professional channels of communication,” the statement said. “We encourage the AFP to duly get in touch with the respective Russian law enforcement agencies.
“Fighting cybercrime that adversely affects people’s lives and damages businesses demands a cooperative, non-politicised and responsible approach from all members of the world community.”
The AFP has successfully extradited people from Poland, Serbia and the UAE in recent years to face criminal – mainly drugs-related – charges in Australia.
But the chances of extraditing Russian hackers appear remote. In 2018, even before the Ukraine invasion, president Vladimir Putin said “Russia does not extradite its citizens to anyone”.
Kershaw’s statement on Friday confirmed what was already assumed about the hackers – they were Russia-based and had been posting the data on a dark web forum linked to the REvil ransomware group.
His comments echoed the home affairs minister, Clare O’Neil, on Thursday, who warned the hackers that Australian authorities were coming for them.
“I want the scumbags behind this attack to know that the smartest and toughest people in this country are coming after you,” she told the parliament.
The AFP established Operation Palladius to investigate the hack in cooperation with Australia’s Five Eyes partners, including the US Federal Bureau of Investigation.
The agency extended its operation to prevent the misuse of Optus customers’ data to also cover Medibank customers.
Medibank has said 9.7 million current and former customers are affected by the breach. That includes 5.1 million Medibank customers, 2.8 million ahm customers and 1.8 million international customers.
The health insurer said the hackers obtained claims for about 160,000 Medibank customers, 300,000 ahm customers and 20,000 international customers. The exposed information included service provider names and codes associated with diagnosis and procedures.
In the days since Medibank refused to pay a ransom, the health claims of hundreds of its customers have been posted on the dark web, including claims related to the termination of pregnancies, harmful use of alcohol and treatment for drug use.
