Massive Australian Health Data Breach: 12.9 Million Records Sold on Dark Web

In one of the largest data breaches in Australian history, cybersecurity experts confirm that highly sensitive health data of 12.9 million Australians, stolen from eScripts provider MediSecure, has been sold on the dark web and is now being offered for resale.

The breach, initially reported by MediSecure in May 2023 as a ransomware attack, has now been revealed to be far more extensive than initially thought. The 6.5 terabyte trove of data includes personal identifying information such as names, addresses, phone numbers, and Medicare numbers, as well as sensitive medical information including prescribed medications and reasons for prescriptions.

Cyber threat intelligence analysts have found strong indications that the data, originally listed for sale at $50,000, has been sold at least once. The entire dataset is now being offered for resale at half the original price - $25,000 - on a separate dark web forum.

The Australian Government, through National Cyber Security coordinator Lieutenant General Michelle McGuinness, acknowledged awareness of the continued advertisements but stated they haven't seen evidence of data beyond the initial sample being published. McGuinness warned Australians against attempting to access the stolen information, reminding that it could be a criminal offense.

Privacy Commissioner Carly Kind expressed concern about the "mosaic approach" where bad actors can piece together personal information from multiple data breaches, exacerbating the risks for affected individuals.

The Australian Government has confirmed that the affected data relates to prescriptions distributed by MediSecure's systems up until November 2023. MediSecure was one of two prescription delivery services operating nationally until late 2023, when the government awarded the service exclusively to Fred IT Group's eRx Script Exchange.

Importantly, the current national prescription delivery service, eRx, is not affected by this cyber incident. Consumers can continue to access medicines safely, and healthcare providers can still prescribe and dispense as usual. The government emphasizes that prescriptions continue to work normally, and people should keep accessing their medications and filling their prescriptions, including those issued up until November 2023.

This incident underscores the growing threat of cybercrime targeting healthcare data and the urgent need for robust cybersecurity measures in the healthcare sector. It also highlights the potential long-term consequences of data breaches, as stolen information can continue to circulate and be exploited long after the initial attack.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.