Medibank Australia Breach: Health Insurer Data Published on Dark Web

Australian health insurer Medibank suffered a devastating breach when attackers, linked to the Russian REvil ransomware group, stole and then published sensitive health claims data for approximately 9.7 million current and former customers on the dark web after Medibank refused to pay the ransom. The published data included names, dates of birth, Medicare numbers, and critically, health claims data revealing mental health treatment, drug and alcohol rehabilitation, HIV status, pregnancy terminations, and other highly sensitive medical information. The publication of health claims data made this one of the most harmful breaches in history in terms of personal impact on victims. Medibank chose not to pay the approximately AU$10 million ransom on the advice of cybersecurity experts who said payment would not guarantee data deletion. The breach was attributed to a stolen employee credential that provided VPN access to Medibank systems. The Australian government attributed the attack to Russian cybercriminals and imposed cyber sanctions.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.