Medibank - Australia's largest private health insurer with close to 4 million customers - was hit by a massive cyberattack and this has resulted in the data of millions of customers being obtained by cybercriminals. Around 9.7 million current and former Medibank customers have been affected by this cyberattack.
As this cyberattack on Medibank is a major online safety and privacy issue, we're going to take a deep dive into what exactly happened, what the private health insurer is doing, and what you can do to protect yourself - especially if you're a Medibank customer.
Just remember that if you need support or someone to talk to, our Sonder support team is available 24/7 to chat whenever you need it.
What happened with this Medibank data breach?
On October 12, 2022, Medibank noted some "unusual" activity on its network but noted that there was "no evidence" of any customer data being stolen at the time.
However, the private health insurer has since confirmed that the private medical details of customers who use its flagship Medibank brand, as well as data of its ahm and international student customers, were obtained by hackers.
The stolen medical details include names, addresses, birthdates, Medicare numbers, contact information and claims data from Medibank.
The hackers demanded a ransom from Medibank or they will release the stolen data online if their demands aren't met. The private health insurer subsequently released a statement that it would not pay the ransom as it would encourage further crime.
On November 9, 2022, hackers followed through on their blackmail threat and released hundreds of names, addresses and other personal details online to the dark web.
Yikes, what is Medibank doing about it?
Following confirmation of the cyberattack, an investigation was launched by federal government agencies after the alleged cybercriminals claiming to have stolen 200 gigabytes of Medibank customer data contacted the private health insurer wanting to negotiate.
Medibank has also announced a cybercrime support package for all Medibank, ahm, and international student customers who were affected by the cyberattack. This package includes:
A hardship package to provide financial support for customers who are in a uniquely vulnerable position as a result of this crime, who will be supported on an individual basis.
Access to Medibank’s mental health and wellbeing support line for all customers, including ahm customers.
Access to specialist identity protection advice and resources from IDCARE.
Free identity monitoring services for customers who have had their primary ID compromised.
Reimbursement of fees for re-issue of identity documents that have been fully compromised in this crime.
The private health insurer has issued a number of apologies and will be contacting current and former customers to recommend what steps to take out of precaution, and will also be contacting customers whose data has been confirmed to be compromised.
What can I do to protect myself?
Due to the large scale of this cyberattack, it's important to stay vigilant in the event of possible cases of identity fraud or further scams, as well as potential financial risk.
If you are/were a Medibank customer, there are several things you can do to protect yourself following this cyberattack in addition to the support package offered by the private health insurer:
Change your passwords and enable multi-factor authentication if available.
If you have other important accounts linked to your email, such as banking and financial services, change those passwords too.
Be wary of scammers who may contact you via email or social media. Never provide passwords or personal details to anyone who may ask for them online and avoid clicking on suspicious links or attachments.
If you receive a call or SMS from someone claiming to be from a financial institution or other organisation, hang up or block the sender, report them to Scamwatch, and contact the organisation by its publicly-available number to confirm the authenticity of the call or message.
Monitor your bank and credit card statements, and any other personal financial accounts. Flag any suspicious activity immediately.
Customers can contact IDCARE, Australia’s free identity and cyber support service, to help develop a plan to limit the damage of identity theft.
If you've been affected by this cyberattack or if need some support or someone to talk to, our Sonder support team is available 24/7 to chat whenever you need it.
If you have any questions or need extra support, we're here to help you anytime in any language. Simply start a chat with us via the home screen of the Sonder app.
Information sourced from: ABC, Medibank, SBS, and The Sydney Morning Herald
Image credit: Medibank
All content is created and published for informational purposes only. It is not intended to be a substitute for professional advice. Always seek the guidance of a qualified health professional.