{"id":27262,"date":"2022-11-12T07:02:08","date_gmt":"2022-11-12T07:02:08","guid":{"rendered":"https:\/\/www.nsemgh.com\/?p=27262"},"modified":"2022-11-12T07:02:09","modified_gmt":"2022-11-12T07:02:09","slug":"australia-blames-russia-for-health-insurance-data-theft","status":"publish","type":"post","link":"https:\/\/www.nsemgh.com\/2022\/11\/12\/australia-blames-russia-for-health-insurance-data-theft\/","title":{"rendered":"Australia blames Russia for health insurance data theft"},"content":{"rendered":"\n

Moscow must he held to account for Russian cybercriminals accused of hacking Australia\u2019s largest health insurer and dumping customers\u2019 personal medical records<\/strong> on the dark web, Australian officials said Friday.<\/p>\n\n\n\n

Australian Federal Police took the unusual step of attributing blame for the unsolved cybercrime that resulted in the personal data of 9.7 million current and former Medibank customers being stolen.<\/p>\n\n\n\n

A group of \u201cloosely affiliated cybercriminals\u201d operating like a business in Russia were likely responsible for the Medibank attack as well as other significant security breaches around the world, Australian Federal Police Commissioner Reece Kershaw said.<\/p>\n\n\n\n

\u201cWe believe we know which individuals are responsible, but I will not be naming them,\u201d Kershaw told reporters. \u201cWhat I will say is that we\u2019ll be holding talks with Russian law enforcement about these individuals.\u201d<\/p>\n\n\n\n

Prime Minister Anthony Albanese, who is a Medibank customer who had personal data stolen, said he had authorized police to reveal where the attack had come from.<\/p>\n\n\n\n

\u201cWe know where they\u2019re coming from, we know who is responsible, and we say that they should be held to account,\u201d Albanese said.<\/p>\n\n\n\n

\u201cThe nation where these attacks are coming from should also be held accountable for the disgusting attacks, and the release of information including very private and personal information,\u201d Albanese added.<\/p>\n\n\n\n

An official from the Russian Embassy in Australia could not be immediately contacted for comment.<\/p>\n\n\n\n

The extortionists have been linked to high-profile Russian cybercrime gang REvil, short for Ransomware Evil and also known as Sodinokibi.<\/p>\n\n\n\n

The Russian Federal Security Service said in January REvil \u201cceased to exist\u201d after several arrests were made at the insistence of the United States.<\/p>\n\n\n\n

An old REvil dark web site had started redirecting traffic to a new site that hosts the stolen Medibank data.<\/p>\n\n\n\n

Fergus Hanson, director of Australian Strategic Policy Institute think tank\u2019s cyber policy center, said he was not surprised that the crime gang was based in Russia.<\/p>\n\n\n\n

A Medibank employee\u2019s stolen username and password, which allowed the hackers to enter the company\u2019s database, had been sold on a Russian dark web forum, Hanson said.<\/p>\n\n\n\n

Hanson doubted that culprits operating in Russia would be brought to justice. <\/p>\n\n\n\n

But Australia could use its offensive cyber capabilities against the gang in Russia and prosecute their affiliates, who police suspect are operating in other countries.<\/p>\n\n\n\n

\u201cThere\u2019s potential to conduct operations against the group to disrupt their operations, but in terms of seeing them go to prison or appear before a court, I think that\u2019s pretty unlikely,\u201d Hanson told Australian Broadcasting Corp.<\/p>\n\n\n\n

Cybercriminals dumped personal medical records on the dark web for a third day on Friday, this time focusing on alcohol-related illnesses, as they pressure Medibank to pay a ransom.<\/p>\n\n\n\n

The criminals began dumping customer records Wednesday<\/strong>, including those involving treatments for HIV and drug addiction, which they described as a \u201cnaughty\u201d list, after Medibank ruled out paying a ransom<\/strong> for the return of the hacked data.<\/p>\n\n\n\n

The focus shifted to terminated pregnancies in Thursday\u2019s dump and on Friday to conditions related to harmful levels of alcohol consumption, in a file the thieves labeled \u201cboozy.\u201d Medical treatment records of more than 700 customers had been published through Friday in what has been described as Australia\u2019s most invasive cybercrime.<\/p>\n\n\n\n

Other personal details of many more customers have also been made public that could leave them vulnerable to identity theft or fraud, including phone numbers and email addresses.<\/p>\n\n\n\n

Confirming the third dump, Medibank CEO David Koczkar said his company was contacting exposed customers and offering support. He expected the daily dumps would continue.<\/p>\n\n\n\n

\u201cThe relentless nature of this tactic being used by the criminal is designed to cause distress and harm,\u201d Koczkar said.<\/p>\n\n\n\n

\u201cThese are real people behind this data and the misuse of their data is deplorable and may discourage them from seeking medical care,\u201d he added.<\/p>\n\n\n\n

The gang, which is becoming increasingly better known as BlogXX within cybersecurity circles, blamed Medibank\u2019s failure to pay a $9.7 million ransom demand. <\/p>\n\n\n\n

\u201cBut we warned you. we always keep our word, if we wouldn\u2019t receive a ransom \u2013 we should post this data, because nobody will believe us in the future,\u201d they posted on Friday. <\/p>\n\n\n\n

Kershaw said Australian government policy did not condone paying ransoms to cybercriminals.<\/p>\n\n\n\n

\u201cAny ransom payment, small or large, fuels the cybercrime business model, putting other Australians at risk,\u201d Kershaw said.<\/p>\n\n\n\n

Australian authorities are hoping the data remains confined to the dark web and is not spread to a wider audience by social media or reported in detail by the news media.<\/p>\n\n\n\n

Albanese urged against anyone accessing the data.<\/p>\n\n\n\n

\u201cWe need to provide a disincentive for this sort of criminal, disgusting behavior that is reprehensible,\u201d Albanese said.<\/p>\n\n\n\n

\u201cIt\u2019s causing a great deal of distress in the community. The government acknowledges this and we\u2019re doing all we can to limit the impact of this and to provide that support to people who are going through this distressing time,\u201d Albanese added.<\/p>\n","protected":false},"excerpt":{"rendered":"

Moscow must he held to account for Russian cybercriminals accused of hacking Australia\u2019s largest health insurer and dumping customers\u2019 personal medical records on the dark web, Australian officials said Friday. Australian Federal Police took the unusual step of attributing blame for the unsolved cybercrime that resulted in the personal data of 9.7 million current and former Medibank […]<\/p>\n","protected":false},"author":8,"featured_media":27263,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_post_source_name":"","_post_source_url":"","footnotes":""},"categories":[1],"tags":[11261,6612,7273,6702,5304,11394,3347,8249,10507,6197,5989,7954,7396,11337,11273,6060,11700,6085,6665,3577,2264,9385,8697,11537,12634,5577,2702,10419,10342,8502,7806,5340,7039,421,3174,8306,6431,5807,3457,5217,5655,5349,5594,8206,9262,6348,3954,36,594],"class_list":["post-27262","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-accused","tag-alcohol","tag-anthony","tag-anthony-albanese","tag-attack","tag-attacks","tag-australia","tag-australian","tag-court","tag-cyber","tag-cybercrime","tag-cybersecurity","tag-data","tag-demand","tag-drug","tag-embassy","tag-evil","tag-fraud","tag-fuels","tag-future","tag-government","tag-hacked","tag-hacking","tag-harmful","tag-health","tag-hiv","tag-identity","tag-justice","tag-law","tag-medibank","tag-model","tag-moscow","tag-phone","tag-police","tag-prime-minister","tag-prison","tag-release","tag-risk","tag-russia","tag-russian","tag-security","tag-social-media","tag-traffic","tag-treatment","tag-united-states","tag-us","tag-will","tag-world","tag-who"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/posts\/27262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/comments?post=27262"}],"version-history":[{"count":0,"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/posts\/27262\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/media\/27263"}],"wp:attachment":[{"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/media?parent=27262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/categories?post=27262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nsemgh.com\/api-json\/wp\/v2\/tags?post=27262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}