Medibank said there is no evidence that the actor behind the incident accessed any customer information or other sensitive data. However, the company decided to remove access to its health insurance service, international student policy management systems, and systems for its insurance business, “ahm.” “We confirm we have successfully taken offline the ahm and international student policy systems and its data, and we are in the process of methodically and safely restarting the systems,” the company said on its website. “The work we have done today continues to show no evidence that customer data has been accessed, however our investigation is ongoing.”
Statement From Medibank CEO
In its statement on Wednesday, Medibank said that ahm and international student customers looking to use its services would have to contact the company via phone. However, the company’s personnel will not be able to access policy information. Customers can still use the company’s health services, including access to their health providers. “I apologise and acknowledge that in the current environment this news may make people concerned. Our highest priority is resolving this matter as transparently and quickly as possible. We will continue to take decisive action to protect Medibank Group customers and our people,” Medibank CEO David Koczkar said in a statement. The company has also notified relevant regulators and authorities, including the Australian Cyber Security Centre, APRA, and the Office of the Australian Information Commissioner. “We recognise the significant responsibility we have to the people who rely on us to look after their health and wellbeing and whose data we hold. We are working around the clock to understand the full nature of the incident, and any additional impact this incident may have on our customers, our people and our broader ecosystem,” Koczkar added.
Australian Companies Under Fire
The last few weeks have been a nightmare for some major Australian companies, their customers, and even the government. In late September, major telco Optus suffered a massive cyberattack where over 2 million customers had sensitive ID data, such as driver’s licenses and passport numbers stolen. In the days to follow, data from rival telco Telstra found its way onto a dark web forum. However, the data was from 2017 and appeared to be a ploy by an opportunistic malicious actor to gain attention. Shortly after, another Singtel-owned company, Dialog Group, informed the public that it suffered a data breach potentially affecting 20 clients and 1,000 employees. Several Australian lawmakers spoke out about Optra’s response to the cyber incident, saying that the company did not act or provide information in a timely manner. Prime Minister Anthony Albanese signaled his intent to change up Australia’s privacy laws to ensure companies report cyberattacks to banks in a timely manner. This would allow banks to promptly secure customer accounts and take any other preventive measures. Making these amendments is likely to be a priority for the Australian government in the coming months, considering that the number of high-profile cybersecurity incidents only seems to be growing. Cybercriminals can use information from data breaches to carry out crimes such as identity theft. If you’re interested in learning more, our easy explainer is the perfect place to begin.
