Medibank hackers dump more data ahead of AGM

The Russian hackers have escalated their assault on Australia’s biggest health insurer ahead of a critical shareholder meeting.

The hacking group behind the Medibank data heist has leaked more customer data to the dark web, ahead of a critical company shareholder meeting on Wednesday.

“Added one more file psycho1.csv in a next folder 13112022,” the hacking group, identified by the AFP and Prime Minister Anthony Albanese as being located in Russia, wrote in a post.

“There is some more records for everybody to know.

“We’ll announce, that next portion of data we’ll publish at Friday, bypassing this week completely in a hope something meaningful happened [sic] on Wednesday.”

The data is thought to include 500 records, including 46 from previous lists, and includes people with chronic conditions such as heart disease, diabetes and asthma, as well as patients with mental illnesses including delirium, which is a temporary condition that particularly effects elderly patients.

“We will continue to support all people who have been impacted by this crime through our Cyber Response Support Program. This includes mental health and wellbeing support, identity protection and financial hardship measures,” Medibank CEO David Koczkar said.

“If customers are concerned, they should reach out for support from our cybercrime hotline, our mental health support line, Beyond Blue, Lifeline or their GP.

“Anyone who downloads this data from the dark web, which is more complicated than searching for information in a public internet forum and attempts to profit from it is committing a crime.”

The latest release comes after almost 10 million current and former Medibank customers had their personal data exposed in one of Australia’s biggest cyber heists.

Other information stolen by the Russian hackers – who accessed Medibank’s customer database after buying one of the company’s high level logins from an online criminal forum – include the names, dates of birth, phone numbers, email addresses and some Medicare and passport numbers of policyholders.

Medibank is holding its annual general meeting on Wednesday, in which the company’s shareholders will vote on performance incentives for its executives and the re-election of its directors. The company controversially decided not to pay a $US10m ($15m) cyber ransom.

Medibank CEO David Koczkar in Melbourne. Picture: Nicki Connolly/NCA NewsWire

Over the weekend, Melbourne-based law firm Maurice Blackburn announced it was considering mounting a class-action lawsuit on behalf of affected Medibank customers.

“Medibank, ahm and international student customers will understandably feel very vulnerable and distressed as a result of this incident,” Maurice Blackburn principal lawyer Andrew Watson said.

As The Australian previously reported Australian Federal Police Commissioner Reece Kershaw has ­issued a veiled threat to the criminals behind the Medibank cyber attack, warning “we know who you are” and promising the ­response to the hack would “match the malicious and far-reaching consequences” caused by their crimes.

Mr Kershaw revealed on Friday that those ­behind the attack had been identified as a group of ­loosely affiliated cyber criminals operating from Russia with a history of conducting “significant breaches in countries across the world”.

“These cyber criminals are ­operating like a business with affiliates and associates who are supporting the business,” he said.

“We also believe that some ­affiliate may be in other countries. Everyone involved in this attack is the focus of the ongoing investigation through the AFP-led Pallidus.”

As part of Operation Pallidus, the AFP is working with other federal agencies, Interpol and Five Eyes law enforcement partners, including the FBI. Mr Kershaw confirmed the AFP knew the names of those responsible, but would keep that secret for now.

“We’ll be holding talks with Russian law enforcement about these individuals,” he said.

Founder of the UK’s National Cyber Security Centre, Ciaran Martin, said there was a “serious safe haven problem” faced by countries such as Australia and Britain in regards to Russia and a number of other countries allowing cyber gangs that targeted Western nations to operate freely within them.

“We have to face up to the ­reality that they (gangs) are pretty effective, well organised … and able to operate with impunity,” he said.

“This threat is here and it’s harder to do something about it … when threat actors are based in unfriendly countries with whom we don’t have law enforcement ­arrangements.”

Originally published as Medibank hackers dump more data ahead of AGM