Australian health insurer Medibank has started informing customers that their personal information was potentially compromised during a recent cyberattack.

The incident was initially identified on October 12 and was deemed as being “consistent with the precursors to a ransomware event”, resulting in certain systems being taken offline for containment purposes. Medibank said its systems were not encrypted by ransomware during the incident.

At first, the company said that it found no evidence that any customer data might have been exfiltrated from its network, but that changed after a threat actor contacted Medibank, claiming that they had stolen roughly 200 gigabytes of data during the cyberattack.

“Medibank has been contacted by a criminal claiming to have stolen 200GB of data. The criminal has provided a sample of records for 100 policies which we believe has come from our ahm and international student systems,” the company announced on Thursday.

The exfiltrated personal information includes full names, addresses, birth dates, phone numbers, medicare and policy numbers, and claims data (such as the location where the customer received medical services).

The attacker also claims to have stolen credit card security information, as well as other types of data, but Medibank says it has not been able to verify the claim yet.

Medibank says it is working on identifying what other types of customer data might have been impacted. The health insurer has more than 3.9 million customers.

“We are making direct contact with the affected customers to inform them of this latest development, and to provide support and guidance on what to do next. We expect the number of affected customers to grow as the incident continues,” the company says.

The company says it has identified and contained the attack before ransomware was deployed on its network and that it has now fully restored the services that were impacted in the incident. However, Medibank also announced a trading halt on its shares.

By Ionut Arghire on Thu, 20 Oct 2022 10:29:04 +0000
Original link