Report: Australian Medicare card numbers are able to be bought on the dark web

AN EXPLOSIVE report claims a vendor on the dark web is auctioning off the Medicare card details of any Australian a criminal buyer might want.

Close up view of a medicare card.

THE government says it is taking seriously a report which claims the Medicare details of every Australian are readily available to be purchased on a popular auction site for illegal products on the dark web.

An investigation led by The Guardian, has uncovered a dark web trader who is exploiting an alleged vulnerability in a government system to advertise the Medicare card details of any Australian upon request, for about $28 each.

According to the dark web trader who goes by the name “the Medicare machine,” complete with a fake Australian government logo, all potential buyers need is the first and last name of an individual and their date of birth to receive someone’s full Medicare card details.

Guardian journalist Paul Farrell verified the authenticity of the seller’s claim by purchasing his own details from the vendor.

I purchased my own Medicare card details from the Darkweb auctioneer for just $20USD. The vendor even uses a fake Aus gov logo pic.twitter.com/k5Ghk05QKK

— Paul Farrell (@FarrellPF) July 3, 2017

The dark web trader — who is listed as a highly trusted vendor with a number of good reviews — is charging 0.0089 bitcoin per person’s details which is currently about $US20. But is reportedly happy to sweeten the deal.

“Fun fact: the Medicare Darkweb seller offered me a freebie of any Australians’ card info because he didn’t want me to leave a bad review,” Mr Farrell wrote on Twitter this morning.

Via the Minister for Human Services, Alan Tudge, the government has issued a statement saying it is taking the report very seriously.

“Claims made by the Guardian newspaper that Medicare card numbers are able to be purchased on the dark web, are being taken very seriously by the government and are under investigation,” the statement said.

“These claims have also been referred to the Australian Federal Police.”

The AFP previously declined to tell The Guardian whether it was investigating any such issue. Meanwhile a spokesperson from the Department of Human Services said the agency was working with other government security agencies to investigate the sale of Medicare records.

A 'no comment' from DHS isn't good enough at this point either. Prima facie evidence of an exploit exposing this data demands explanation.

— Tim Watts MP (@TimWattsMP) July 3, 2017

“I have received assurance that the information obtained by the journalist was not sufficient to access any personal health record,” said the statement from Minister Tudge’s office.

“The only information claimed to be supplied by the site was the Medicare card number. The journalist was asked to provide his own name and date of birth in order to obtain the Medicare card number.

“Any apparent unauthorised access to Medicare card numbers is nevertheless of great concern.”

However Mr Farrell was quick to hit back, saying the Minister’s statement completely missed the point.

“Alan Tudge’s statement really misses the point — this type of Medicare information is essential for identity fraud used for organised crime,” he wrote on Twitter.

As pointed out in the original report, such information could be highly coveted by criminals who intend to commit fraud. They are not necessarily interested in health records.

The information could be used to produce fake Medicare cards with legitimate information. Criminal syndicates could then use the cards to commit identity fraud and use them to aid in buying goods such as property and cars. They could also potentially divert Medicare rebates into a chosen account.

Assistant treasurer Michael Sukkar on @FarrellPF’s exclusive: “It’s extremely concerning. We take extraordinarily seriously (data we hold)"

— Mark Di Stefano 🤙🏻 (@MarkDiStef) July 3, 2017

The story has generated plenty of discussion online with people raising questions about the government’s ability to safeguard such important information.

“I didn’t think it was possible for my trust in the government’s ability to store our information securely to go lower, but there you go,” wrote one reddit user on the Australian subreddit forum where users were discussing the article.

“Medicare details are only the tip of the iceberg. The dark web has been selling your credit card/personal details for years,” said another.

News.com.au has contacted the Department of Human Services for comment.