Article
Medibank Confirms Security Breach Affecting 9.7 Million Customers’ Data
Medibank said criminals accessed the data of 9.7 million current and former customers in an October 2022 ransomware attack. See what was taken.
Read more
Significant cyber incident
Medibank ransomware and data theft, 2022
In October 2022 Medibank, one of Australia's largest private health insurers, found that attackers had taken customer data, later released on the dark web.
In short
In October 2022 Medibank, one of Australia's largest private health insurers, found that attackers had taken customer data, later released on the dark web. Australian agencies say about 9.7 million records or people were affected, including names, dates of birth, Medicare numbers and health claims data. The OAIC alleges in a Federal Court filing that the attackers got in with stolen contractor credentials on a VPN that needed no multi-factor authentication.
What happened
Medibank said it detected unusual activity on its network, took its ahm and international student policy systems offline, and at first said there was no evidence that customer data had been accessed (Medibank statements). The OAIC began preliminary inquiries on 20 October 2022 and says the breach was notified to it on 25 October 2022.
The OAIC later alleged in a Federal Court filing that the attackers used credentials stolen from a contractor’s IT service desk employee, logged on to the Medibank VPN from about 23 August 2022, and from about 25 August to about 13 October 2022 reached many systems. It alleges about 520 gigabytes of data was taken, including health claims data. These are allegations by the regulator, which Medibank has the right to answer in court.
The filing says a threat actor contacted Medibank on 19 and 22 October 2022 with sample data, and published stolen data on the dark web between 9 November and 1 December 2022. On 11 November 2022 the AFP Commissioner said police believed those responsible were in Russia.
In January 2024 Australia, the US and the UK sanctioned Russian national Aleksandr Ermakov over the attack. In February 2025 Australia sanctioned a Russian entity, ZServers, and five individuals who provided infrastructure used to host and release the data.
Timeline
-
7 August 2022
Alleged by the OAIC: Medibank credentials of a contractor's IT service desk employee are stolen from his personal computer using a variant of malware.
-
12 August 2022
Alleged: the threat actor logs on to the Medibank Microsoft Exchange server and tests the credentials for the admin account.
-
23 August 2022
Alleged: the threat actor logs on to the Medibank Global Protect VPN for the first time using only the stolen credentials.
-
24 and 25 August 2022
Alleged: endpoint detection alerts are generated but not appropriately triaged or escalated.
-
25 August to 13 October 2022
Alleged: the actor accesses numerous systems and exfiltrates about 520 gigabytes of data, including from the MARS Database.
-
11 October 2022
Medibank's security team triages a high severity incident and engages its forensics partner.
-
16 October 2022
At the latest, a forensics analyst notes suspicious volumes of data leaving the network (per the OAIC filing).
-
19 and 22 October 2022
A threat actor contacts Medibank and provides files with sample data (per the OAIC filing).
-
20 October 2022
The OAIC starts preliminary inquiries with Medibank.
-
25 October 2022
The breach is notified to the OAIC.
-
9 November to 1 December 2022
A threat actor publishes stolen data on the dark web (per the OAIC filing).
-
11 November 2022
AFP Commissioner says police believe those responsible are in Russia and names Operations Pallidus and Guardian.
-
1 December 2022
The OAIC opens a formal investigation.
-
30 March 2023
The Information Commissioner accepts a representative complaint against Medibank.
-
23 January 2024
Australia, the US and the UK sanction Aleksandr Ermakov. Treasury says Australia acted the day before.
-
5 June 2024
The OAIC announces civil penalty proceedings in the Federal Court; the concise statement is lodged on 19 June 2024.
-
12 February 2025
Australia sanctions ZServers and five individuals over infrastructure used to host and release the data.
How the attack worked
The most detailed technical account is the concise statement the OAIC filed in the Federal Court in June 2024. It contains allegations, not court findings. Parts of it, such as the names of the contractor, the malware and some tools, are blacked out in the public copy.
Stolen credentials
The OAIC alleges that an IT service desk employee of a Medibank contractor had saved Medibank usernames and passwords in a browser profile. They synced to his personal computer, and on or around 7 August 2022 a threat actor stole them from that computer using a variant of malware. The employee also had an elevated admin account with wide access (Valid Accounts, T1078).
Remote access without a second factor
The OAIC alleges the attacker tested the credentials on the Exchange server on 12 August 2022 and then logged on to the Global Protect VPN from about 23 August 2022. It says the VPN needed only a device certificate or a username and password, with no multi-factor authentication (External Remote Services, T1133).
Missed alerts and data theft
The OAIC alleges that endpoint detection alerts on 24 and 25 August 2022 were not appropriately triaged or escalated. It says that from about 25 August to about 13 October 2022 the attacker reached systems including the MARS Database and took about 520 gigabytes of data, including names, Medicare numbers and health claims data.
Extortion and release
The filing says a threat actor contacted Medibank on 19 and 22 October 2022 with sample data and published data between 9 November and 1 December 2022. The US Treasury calls this a ransomware attack and says the actors are believed to be linked to the REvil gang. The public sources opened do not say whether files were encrypted, and they name no ransomware strain.
- Steal credentialsA contractor’s saved Medibank login was stolen from his personal computer on or around 7 August 2022 (alleged)Technique T1078 (MITRE ATT&CK, opens in a new tab)
- Test and log onThe credentials were tested on Exchange on 12 August and used on the VPN from about 23 August, with no multi-factor authentication (alleged)Technique T1133 (MITRE ATT&CK, opens in a new tab)
- Alerts not escalatedEndpoint alerts on 24 and 25 August were not appropriately triaged or escalated (alleged)
- Reach customer dataFrom about 25 August the actor accessed many systems, including the MARS Database (alleged)
- Take dataAbout 520 gigabytes was exfiltrated (alleged)
- Extort and publishThe actor contacted Medibank on 19 and 22 October and published data from 9 November
ATT&CK techniques
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the US Treasury, 23 January 2024: Alexander Ermakov played a pivotal role in the 2022 ransomware attack on Medibank, and the actors behind it are believed to be linked to the REvil gang.
Attributed by the Australian Government, January 2024: Russian citizen Aleksandr Ermakov was linked to the compromise of the Medibank network by the ASD and AFP under Operation Aquila.
The AFP said on 11 November 2022 that it believed those responsible were in Russia and operated as loosely affiliated criminals, and that it believed it knew which individuals were responsible.
Sources differ on the spelling of the first name (Alexander in the US text, Aleksandr in the Australian text). The ransomware strain used is not named in the public sources opened, so no malware page is linked.
In February 2025 Australia sanctioned ZServers and five individuals for providing infrastructure used to host and release the stolen data. That is a statement about infrastructure, not about who carried out the intrusion.
Impact
Records: Treasury says data linked to about 9.7 million current and former customers and authorized representatives was stolen. The Australian ministers say 9.7 million records were stolen. The OAIC says 9.7 million Australians were affected. Sources differ in what the number counts.
Data: names, dates of birth, Medicare numbers and sensitive medical information were released (Treasury). The OAIC filing alleges about 520 gigabytes was taken, including health claims data such as diagnosis and procedure codes.
Harm: the Commissioner said release on the dark web exposed people to a material risk of identity theft, extortion and financial crime.
Legal: the OAIC seeks civil penalties of up to 2,220,000 Australian dollars per contravention, and a representative complaint was accepted on 30 March 2023.
Service: Medibank took its ahm and international student policy systems offline and later restored them.
Financial cost to Medibank is not given in the sources opened.
Government and regulator response
- Medibank: took its ahm and international student policy systems offline, engaged specialist cyber firms, spoke to the ACSC, APRA, the OAIC and other bodies, restored access to those systems, and said it would share technical information with industry peers (Medibank statements).
- 20 October 2022: The OAIC began preliminary inquiries. 25 October 2022: the Australian Government released a factsheet for people who may be affected.
- 11 November 2022: The AFP said Operation Pallidus was investigating and Operation Guardian was searching for people accessing the released data. It restated that government policy does not condone paying ransoms.
- 1 December 2022: The OAIC opened a formal investigation.
- 23 January 2024: Australia imposed its first autonomous cyber sanction on Aleksandr Ermakov, with matching US and UK action.
- 5 June 2024: The OAIC announced civil penalty proceedings in the Federal Court.
- 12 February 2025: Australia sanctioned ZServers and five individuals.
Lessons
-
Require MFA on remote access
The OAIC alleges the VPN needed no multi-factor authentication, so stolen credentials were enough. Put MFA on every remote access path.
-
Control contractor and admin accounts
The OAIC alleges a contractor's admin account had wide access and its login was saved in a browser. Limit admin rights and ban saved work passwords.
-
Act on security alerts
The OAIC alleges endpoint alerts in late August were not appropriately triaged or escalated. Make sure every alert has an owner and a deadline.
-
Expect extortion, not only encryption
The actor contacted Medibank with sample data and then published records. Plan for data theft and leak, even without encrypted systems.
-
Know your regulator duties early
The OAIC began inquiries within days. Prepare breach notification and customer support before an incident.
-
Sensitive data raises the bar
The OAIC says health data and the size of the firm raise what steps are reasonable. Protect health data accordingly.
What to check in your own organization
-
VPN and remote access
Confirm every VPN and remote access path requires multi-factor authentication, not only a username and password or a device certificate.
-
Saved credentials
Check whether staff and contractors can save work passwords in personal browser profiles that sync to personal devices.
-
Admin accounts
List elevated accounts held by contractors and service desk staff, and cut their reach to what the task needs.
-
Alert triage
Test that endpoint alerts reach a monitored queue and are escalated within a set time, including those sent to a shared mailbox.
-
Data volume monitoring
Alert on large outbound transfers from databases that hold customer or health data.
-
Third-party access
Ask IT service providers how their staff protect credentials to your systems.
-
Breach playbook
Write down who notifies the regulator and customers, and how you would answer an extortion contact.
Where it happened
Questions
When did the Medibank attack happen?
The OAIC alleges the intrusion ran from about 25 August to about 13 October 2022, after credentials were stolen around 7 August 2022. Medibank's first public statement came in October 2022.
How many people were affected?
Sources use 9.7 million: Treasury says linked to about 9.7 million customers and representatives, the ministers say 9.7 million records, and the OAIC says 9.7 million Australians. Sources differ on what is counted.
Who was behind it?
Australia, the US and the UK sanctioned Russian national Aleksandr Ermakov in January 2024. Treasury says the actors are believed to be linked to REvil. The AFP believed those responsible were in Russia.
Was Medibank penalized?
Not in the sources opened. The OAIC filed civil penalty proceedings in the Federal Court in 2024 alleging serious interference with privacy. These are allegations and the outcome is not covered here.
Did Medibank pay a ransom?
The sources opened do not say. The Australian Government says it does not condone paying ransoms.
What did the sanctions do?
They make it a criminal offense in Australia to provide assets to or deal with the assets of the sanctioned people, and the person is banned from entering Australia.
In our research
Sources
- United States, Australia, and the United Kingdom Sanction Russian Cyber Actor Responsible for the Medibank Hack (23 January 2024) US Department of the Treasury
- Cyber sanctions in response to Medibank Private cyber attack Australian Minister for Home Affairs
- Further cyber sanctions in response to Medibank private cyberattack (12 February 2025) Australian Minister for Home Affairs
- Statement by AFP Commissioner Reece Kershaw on Medibank Private data breach (11 November 2022) Australian Federal Police
- OAIC making inquiries with Medibank (20 October 2022) Office of the Australian Information Commissioner
- OAIC opens investigation into Medibank over data breach (1 December 2022) Office of the Australian Information Commissioner
- OAIC takes civil penalty action against Medibank (5 June 2024) Office of the Australian Information Commissioner
- Australian Information Commissioner v Medibank Private Limited, concise statement (VID497/2024) Federal Court of Australia, via OAIC
- Representative complaint: Medibank data breach (3 June 2024) Office of the Australian Information Commissioner
- Advice on Medibank data breach (25 October 2022) Office of the Australian Information Commissioner
- Medibank cyber incident Medibank Newsroom (ASX release)
- Medibank cyber incident update Medibank Newsroom
- Cyber incident update Medibank Newsroom
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.