Medibank hackers have continued their malicious extortion scheme with the daily drip of data leaks, this time publishing information related to mental health patients on the group’s darkweb blogsite.
Last night, the hackers leaked a new data dump labelled “psychos”, which comprises hundreds of insurance claims which could be attributed to mental health treatments.
The post also revealed that the hackers would pause the daily leaks till Friday, hoping “something meaningful” may happen at the company’s annual general meeting this Wednesday.
“We’ll announce, that next portion of data we’ll publish at Friday, bypassing this week completely in a hope something meaningful happened on Wednesday [sic],” said the hacker.
On Friday, the AFP named Russia as the home of the hackers, confirming the involvement of the notorious REvil ransomware group.
The #Medibank hackers have posted an update. pic.twitter.com/aZc70p9zaG
— Brett Callow (@BrettCallow) November 14, 2022
Cyber response support program
Medibank chief executive David Koczkar said: “We will continue to support all people who have been impacted by this crime through our Cyber Response Support Program.
“This includes mental health and wellbeing support, identity protection and financial hardship measures.
"If customers are concerned, they should reach out for support from our cybercrime hotline, our mental health support line, Beyond Blue, Lifeline or their GP.
“Anyone who downloads this data from the dark web, which is more complicated than searching for information in a public internet forum and attempts to profit from it is committing a crime.”
What happened?
Australian insurance provider Medibank Private detected unusual activity on its networks on October 12, 2022, which is now confirmed to be a major cyber incident by the company.
The cyber-attack compromised the data of all its 9.7 million current and former customers, which includes Medibank, ahm and international student customers' data.
The most serious breach was for around 500,000 customers who have had private health information stolen, including health claims and personal information.
It took nearly a fortnight for the company to confirm the severity of these attacks, which includes a brief period where the company resumed 'normal operations', brushing off the gravity of the attack.
Following ransom demands from the hacker, the company announced on Tuesday that no ransom will be paid to the perpetrator of the data theft.
Subsequently, the hackers had given Medibank an ultimatum of 24 hours to pay the ransom.
In the early hours of Wednesday, the hackers leaked their first dump of customer data, threatening to leak further data if their demands were not met.
Subsequently, on Thursday, the hackers leaked sensitive data containing abortion-related information about Medibank customers.
The data dumps continued on Friday as well, where the hackers released the third dump of sensitive data, including information on people’s mental health status and drug and alcohol use.
What should I do?
Medibank said that it would inform the customers of the nature of the data leak, and customers who were directly affected would be notified and provided with guidance on what to do.
The company has initiated a cyber response support program, which includes mental health and wellbeing support, identity protection and financial hardship measures.
The company adds that customers should be vigilant with all online communications and transactions including:
- being alert for any phishing scams via phone, post or email;
- verifying any communications received to ensure they are legitimate;
- not opening texts from unknown or suspicious numbers; and
- changing passwords regularly with ‘strong’ passwords, not re-using passwords and activating multi-factor authentications on any online accounts where available.
It also reminded customers that it will never contact them asking for passwords or sensitive information.
Given the nature of the stolen data that continues to be released on a dark web forum, we’re in the process of contacting customers and we urge our customers to reach out for support https://t.co/mONh6RGEXt
— Medibank (@medibank) November 13, 2022