Medibank reveals hack is much wider than thought

The health insurer has admitted the cyber breach on its network is much bigger than first thought as it ‘unreservedly apologises’ to customers.

Medibank said it would “continue to analyse” what it had received to understand the total number of customers impacted and what information had been stolen.

Medibank has revealed the cyber breach on its network is much wider than originally thought, after the criminal responsible sent the health insurer another 1000 policy records that included personal and health claims data.

While the breach was originally believed to have impacted only international student customers on Medicare’ subbrand, ahm, the hack now includes Medibank customer data.

In a statement, the health insurer said this was “a distressing development” and “unreservedly apologised” to customers.

“We have received a series of additional files from the criminal. We have been able to determine that this includes a copy of the file received last week containing 100 ahm policy records including personal and health claims data (and) a file of a further 1000 ahm policy records – including personal and health claims data,” the statement read.

“Given the complexity of what we have received, it is too soon to determine the full extent of the customer data that has been stolen.”

The development follows news yesterday that investigations into the hack revealed two seperate criminals were involved, one who had stolen credentials and a second who had bought them off a Russian online criminal forum.

Medibank said it would “continue to analyse” what it had received to understand the total number of customers impacted and what information had been stolen.

“We have taken the step of making this announcement as we believe it is important to notify our customers of this development,” the statement read.

“As we continue to investigate the scale of this cybercrime, we expect the number of affected customers to grow as this unfolds.”