Medibank, one of Australia’s largest private health insurers, has told its investors and customers that a “sample” of data from its approximately 9.7 million customers has been posted on a “dark web forum “.
Names, passport numbers, dates of birth, addresses and medical information are among the personal data posted anonymously on Wednesday morning.
“The files appear to be a sample of data that we previously determined was accessed by the criminal,” the company said in a statement to the Australian Securities Exchange.
“We expect the criminal to continue posting files to the dark web,” she continued.
The leaked data was posted on a forum that cannot be found using regular browsers.
“We will continue to post partial data,” the hackers warned on the forum.
The company revealed on Monday that a cyberattack had allowed access to the names, dates of birth, addresses, phone numbers and emails of its customers.
An anonymous Internet user said on Tuesday on a hacking blog that “the data (would) be published in 24 hours”, a message widely taken up by local media.
Medibank then called on its customers to be “vigilant” in the face of this “worrying” threat, issued a day after the insurer ruled out paying a ransom.
Cybercrime experts had estimated that paying a ransom had only a “limited chance” of ensuring the return of stolen data, David Koczkar, chief executive of Medibank, said at the time, adding that it could encourage the direct extortion from its customers.
The Medibank hack comes after an attack in September on the country’s second-largest mobile operator, Optus, which leaked the personal details of some nine million Australians, nearly a third of the population.
