Illustration: Supimol Kumying | Shutterstock
The personal and health information of 12.9 million MediSecure customers was stolen in an April 2024 ransomware attack on the Australian digital prescriptions service. These individuals had received services from MediSecure between March 2019 and November 2023.
The breach was discovered in April 2024 when the company discovered a database server containing sensitive information about the individuals that hackers had encrypted. Further investigation revealed that the 6.5 TB of data stored on the server was likely extracted by a “malicious third-party actor.” To make matters worse, MediSecure claims in an incident report that it is “unable to identify the specific impacted individuals despite making all reasonable efforts to do so due to the complexity of the data set.”
During the initial investigation, the encrypted server could not be examined to find what specific information was leaked. On May 17, the company restored a complete server backup with IT specialists’ assistance and started investigating the affected information. After a “complex and time-consuming” analysis, the company was able to confirm that the following data was affected:
- Full name
- Title
- Date of birth
- Gender
- Email address
- Address
- Phone number
- Individual healthcare identifier (IHI)
- Medicare card number, including individual identifier, and expiry
- Pensioner Concession card number and expiry
- Commonwealth Seniors card number and expiry
- Healthcare Concession card number and expiry
- Department of Veterans’ Affairs (DVA) (Gold, White, Orange) card number and expiry
- Prescription medication, including name of drug, strength, quantity and repeats
- Reason for prescription and instructions
MediSecure is now reviewing the data set exposed on a dark web forum to identify impacted individuals following the backup’s restoration. The company also sought funding from the government for “the limited and confined purpose of assisting with the costs associated with responding to the incident” but was denied.
In the News: Arrested Russians plead guilty to LockBit Ransomware involvement
