In a statement issued to the ASX on Monday, the company said the attacker(s) had "accessed the name, date of birth, address, phone number and email address for around 9.7 million current and former customers and some of their authorised representatives. This figure represents around 5.1 million Medibank customers, around 2.8 million ahm customers and around 1.8 million international customers".
When it first announced its systems had been breached, Medibank said there was no indication of any sensitive data having leaked. Later, it said the data stolen was limited to ahm and international students. Even later, it said data of all its 3.9 million customers could have been taken.
And finally, on 27 October, the company said patient information from My Home Hospital, a joint venture between Calvary and Medibank implemented on behalf of Wellbeing SA and the South Australian Government, had also been accessed by the attacker(s).
|
|
To be clear, I’m in no way suggesting that Medibank should’ve paid - it shouldn’t – but this seems like a rather odd claim. 2/2
— Brett Callow (@BrettCallow) November 6, 2022
However, both Medicare numbers and passport numbers, but not their respective expiry dates, had been accessed, the insurer said.
Health claims for 60,000 Medibank customers, around 300,000 ahm customers and around 20,000 international customers were also accessed by the attacker(s), the company added.
"This includes service provider name and location, where customers received certain medical services, and codes associated with diagnosis and procedures administered. Additionally, around 5200 My Home Hospital patients have had some personal and health claims data accessed and around 2900 next of kin of these patients have had some contact details accessed," Medibank said.
The data accessed included "health provider details, including names, provider numbers and addresses".
On the plus side, Medibank said health claims data for extras services (such as dental, physio, optical and psychology) and credit card and banking details had not been accessed.
Medibank chief executive David Koczkar said the company would not agree to pay any ransom to the attacker(s).
"Based on the extensive advice we have received from cyber crime experts, we believe there is only a limited chance paying a ransom would ensure the return of our customers’ data and prevent it from being published," he said.
"In fact, paying could have the opposite effect and encourage the criminal to directly extort our customers, and there is a strong chance that paying puts more people in harm’s way by making Australia a bigger target.
“It is for these reasons we have decided we will not pay a ransom for this event."
He said the company had resumed normal business operations and there were no signs of suspicious activity inside its systems since 12 October.
