It was the Russians! Cyber network named by AFP as data hacking culprits

Police have confirmed a Russian network was behind the hacking of customer data held by Australia’s largest health insurer Medibank.

Nov 11, 2022, updated May 22, 2025
Australian Federal Police Commissioner Reece Kershaw.
Australian Federal Police Commissioner Reece Kershaw.

ā€œWe believe those responsible for the breach are in Russia,ā€ Australian Federal Police commissioner Reece Kershaw told reporters in Canberra on Friday.

ā€œOur intelligence points to a group of loosely affiliated cyber criminals who are likely responsible for past significant breaches in countries across the world.ā€

Advertisement

He said the crime had the potential to impact millions of Australians and damage a significant Australian business.

ā€œThis cyber attack is an unacceptable attack on Australia and it deserves a response that matches the malicious and far-reaching consequences that this crime is causing.ā€

Kershaw said talks would be held with Russian law enforcement about the individuals involved, who were known but would not be publicly named at this stage.

Prime Minister Anthony Albanese earlier told reporters he was ā€œdisgusted by the perpetrators of this criminal actā€, as he authorised the AFP boss to disclose the information.

The hackers had thumbed their noses at the government after being warned the toughest ā€œcyber gunsā€ in Australia are coming after them, releasing more sensitive details of customers’ medical records on the dark web overnight.

The ransomware group added a file named ā€œBoozy.csvā€ to the dark web, which appears to contain information related to alcohol issues after a data dump on Thursday named ā€œabortions.csvā€.

ā€œYou telling that is disgusting (woof-woof), that we publish some data,ā€ they wrote on Friday in the blog seen by AAP.

ā€œBut we warned you. we always keep our word, if we wouldn’t receive a ransom – we should post this data, because nobody will believe us in the future.ā€

The group claimed on Thursday it had demanded a ransom of $US1 for each of Medibank’s 9.7 million affected customers, for a total of $US9.7 million (almost $A15 million).

Medibank CEO David Koczkar said he expected the ā€œdisgracefulā€ release of customer data to continue each day.

Stay informed, daily

ā€œIt’s obvious the criminal is enjoying the notoriety,ā€ he said.

ā€œThe relentless nature of this tactic being used by the criminal is designed to cause distress and harm. These are real people behind this data and the misuse of their data is deplorable and may discourage them from seeking medical care.ā€

Home Affairs Minister Clare O’Neil said she felt the pain of those affected.

Advertisement

ā€œThere is an enormous amount of work that has gone into trying to stop harm resulting from this, trying to wrap our arms around the victims of this horrible crime,ā€ she told Nine’s Today Show.

It’s believed the hackers are using medical reference codes to sift through the data they stole to generate files on specific health issues.

The AFP and the Australian Signals Directorate were the ā€œcyber gunsā€ of the federal government and were working hard to disrupt the hackers, Ms O’Neil said.

The minister said Australian businesses needed to wake up from the ā€œslumberā€ about cybersecurity threats.

The first wave of files dropped on Wednesday included names, birthdates, addresses, email addresses, phone numbers, health claims information, Medicare numbers for Medibank’s ahm customers, and passport numbers for international student clients.

Medibank has confirmed details of almost 500,000 health claims have been stolen, along with personal information, after the group hacked into its system last month.

No credit card or banking details were accessed.

Medibank has created a one-stop shop of mental health and other support services that can be accessed by affected customers via its website.

Lifeline 13 11 14

beyondblue 1300 22 4636

Want to see more stories from InDaily Qld in your Google search results?

  1. Click here to set InDaily Qld as a preferred source.
  2. Tick the box next to "InDaily Qld". That's it.
    Advertisement
    Archive
    Advertisement