Australian health insurer says all customer data was hacked

Rod McGuirk, Associated Press

CANBERRA, AUSTRALIA (AP) — Australia’s largest health insurer said Wednesday that cybercriminals have killed all four million of its customers as the government introduced legislation to tighten penalties for companies that fail to protect the personal information of their customers. announced that the data was hacked.

Medibank said a “substantial amount of health insurance claims data” was also accessed in the breach, and was reported to police a week after trading in the company’s stock was halted.

The thieves reportedly demanded a ransom and threatened to release the diagnosis and treatment of a high-profile client.

Medibank says its priority is to find the specific stolen data about each customer and share that information with those customers.

The company had previously said it believed the infringement was limited to its subsidiaries and international students.

In a statement to the Australian Securities Exchange, Medibank Chief Executive Officer David Kotker said: “Our investigation has determined that this criminal has obtained all the personal data and personal data of our private health insurance customers. It turned out that they accessed a large amount of health insurance claims data.

“This is a horrific crime. This is a crime aimed at inflicting the greatest harm on the most vulnerable members of our community,” added Kotker, who apologized to customers.

Government plans urgent legal change on cybersecurity regulations after hackers stole personal data of nearly 10 million current and former customers of Optus, Australia’s second largest wireless operator .

Optus found on September 21st that the personal data of more than a third of Australia’s 26 million people had been stolen.

In presenting amendments to the privacy law to Congress on Wednesday, Attorney General Mark Dreyfuss said both companies and the online retail intermediary that lost the data of 2.2 million customers in a hack revealed two weeks ago. He mentioned MyDeal, which is

“As the Optus, Medibank and MyDeal cyberattacks have recently highlighted, data breaches can cause severe economic and emotional harm to Australians and this is unacceptable,” Dreyfuss told parliament. Told.

“Governments, businesses and other organizations have an obligation to protect Australians’ personal data rather than treating it as a commercial asset,” Dreyfus added.

The government is critical of companies that collect more customer data than necessary to profit from it in ways unrelated to the services for which the information was provided.

The penalties for serious breaches of the Privacy Act will increase from the current AU$2.2 million ($1.4 million) to AU$50 million ($32 million) under the proposed amendments.

Additionally, if revenues exceed AUD 50 million ($32 million) in any given period, companies can be fined up to 30% of their revenues.

Medibank said Wednesday it does not have cyber insurance and estimated the hack could cost it A$25 million ($16 million) to A$35 million ($22 million) in lost revenue by early next year.

A halt to Medicare trading was lifted on Wednesday, with stocks dropping more than 14% in early trading.

Copyright 2022 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.