REvil ransomware group lists medibank.com.au on its leak site

• Ransomware group: REvil
• Country: Australia
• Sector: Healthcare
• Announcement date: November 7, 2022

The REvil ransomware group has published a post claiming that data belonging to medibank.com.au has been compromised. This announcement, made on a leak site, suggests a significant security incident involving the Australian-based health insurance provider.

The alleged incident

On November 7, 2022, the REvil group listed medibank.com.au on their leak site. The group claims to have gained access to the organization's data. While the group has made this public claim, information regarding this specific group remains limited. Ransomware groups often use leak sites as a tool for double extortion, a tactic where attackers not only encrypt an organization's internal systems but also threaten to release sensitive data publicly to increase pressure for ransom payments.

Such claims are a common feature of modern cyber extortion campaigns. When a group lists a target on a leak site, it serves as a public notification of the alleged breach. However, the presence of a name on a leak site does not inherently confirm the scope or the success of the intrusion until further verification occurs.

Data involved in the claim

Regarding the specifics of the alleged breach, there is no screenshot or detailed information available regarding the nature of the data allegedly leaked. The listing does not provide information concerning the volume of files or the specific categories of information that were targeted. Consequently, the listing names no data types.

Potential risks and implications

This claim may create a negative perception regarding the organization's data security processes. If the data leak is verified, legal processes under relevant regulations may be triggered due to the confidentiality of sensitive data in the healthcare sector. The alleged breach may lead to secondary risks for the organization's customers, such as identity theft or targeted phishing attacks.

Furthermore, it may also raise indirect security concerns for the organization's supply chain partners. In the event of a successful breach, organizations often face the challenge of managing both technical remediation and the legal complexities of data privacy compliance. Defensive measures typically include implementing multi-factor authentication, maintaining offline backups, and conducting regular vulnerability assessments to mitigate such risks.

Organization profile

Medibank is an Australian-based private health insurance provider. It offers health insurance products and health services to millions of customers.