MediSecure has collapsed just weeks after a large-scale data breach was revealed

The e-script provider, which last month revealed it was the victim of a large-scale data breach, has collapsed into administration.

MediSecure was an electronic prescription management service.

MediSecure, the e-script provider which last month revealed it was the victim of a large-scale data breach, has collapsed into administration.

FTI Consulting’s Vaughan Strawbridge and Paul Harlond were appointed as administrators on June 3.

Mr Strawbridge has previously been involved with high profile administrations including acting as lead administrator for Virgin Australia.

“We recognise the significant concern and the impact of the recent cyber incident,’’ Mr Strawbridge said in a statement issued on Wednesday morning.

“The company has been in contact with the Australian Government with respect to providing information in response to that incident.

“Our role as administrators and liquidators includes investigating the affairs of the company to identify reasons for its failure, and to examine options that may be available to recover assets for the benefit of creditors of the companies.

“We will be speaking to the Australian Government about what they need from the company and the next steps in the response to the cyber incident.”

FTI Consulting has also been appointed as liquidator of related company Operations MDS.

Melbourne-based MediSecure announced in mid-May that it had been the victim of a large scale data breach, and has since all-but shut down its website.

Only one page with updates on the data breach remains.

The investigation into the data breach has drawn in agencies including the Australian Federal Police, the Australian Signals Directorate and the Australian Cyber Security Centre, with the company saying in a statement on May 13 that a third-party service provider was involved.

“MediSecure has identified a cyber security incident impacting the personal and health information of individuals. We have taken immediate steps to mitigate any potential impact on our systems,” the statement said.

“While we continue to gather more information, early indicators suggest the incident originated from one of our third-party vendors.

“MediSecure takes its legal and ethical obligations seriously and appreciates this information will be of concern.

“MediSecure is actively assisting the Australian Digital Health Agency and the National Cyber Security Coordinator to manage the impacts of the incident. ­MediSecure has also notified the Office of the Australian Information Commissioner and other key regulators.”

The most recent update, on May 31, revealed the company was reviewing data uploaded to the dark web to identify individuals who might be affected, and had asked the federal government for financial assistance to facilitate this process.

“In light of recent media reports, MediSecure wishes to clarify that it sought funding from the Commonwealth Government for the limited and confined purpose of assisting with the costs associated with responding to the incident, and the request was not for funding MediSecure’s operational costs unrelated to the cyber-attack,’’ the company said at the time.

“In any event, that request was denied. MediSecure has to date continued to work closely with the National Cyber Security Coordinator, the Australian Federal Police, the Australian Signals Directorate, and the Office of the Australian Information Commissioner in a manner consistent with Australia’s national security interests and the community’s expectations.

“We have also been working with cyber and forensic experts from McGrathNicol Advisory in collaboration with the National Cyber Security Coordinator, to endeavour as quickly as possible to confirm the extent of the data breach and all individuals impacted.

“We are grateful for their support, without which we would be unable to make progress with respect to the incident response.’’

There has been no update from the company since that time on the progress of its investigations.

National cyber security co-ordinator Michelle McGuinness confirmed last month that the prescriptions of patients who had used MediSecure’s electronic prescription service up until November last year had been compromised in the MediSecure breach.

GPs and other medical practitioners involved in prescribing and the handling of electronic prescriptions have also been affected.

MediSecure’s most recent financial statements, for the 2023 financial year, show it made a profit of $1.8m on revenue of $6.9m.

The company lost a federal contract last year however, with that work being awarded to another company.

MediSecure said in its financial statements that it was “not expected to generate significant revenues from January 2024 to June 2024 and has accumulated losses to date’’.

A first meeting of MediSecure’s creditors is expected to be held in the middle of this month.

 

 

Originally published as MediSecure has collapsed just weeks after a large-scale data breach was revealed