Ransomware Gang Allegedly REvil Threatens To Spread Data of 9.7 Million Australian Insurance Company Customers

Medibank also acknowledged the ransomware group accessed about 9.7 million customer personal information. (photo: doc. Pixabay)

JAKARTA - Medibank again has to face the ransomware gang. They threatened to disclose the personal information of millions of customers of the Australia-based private health insurance giant if they did not pay the ransom.

They are suspected to be a ransomware group linked to the REvil gang, claimed to be based in Russia. The hacking incident is known to have occurred on October 13 last. At that time, Medibank said it detected unusual activity on its network and took immediate steps to address it.

A few days later, the company stated customer data may have been stolen. And recently, Medibank also admitted that the ransomware group accessed about 9.7 million customers' personal information, including names, dates of birth, email addresses and passport numbers.

Furthermore, they also accessed the health claims data of nearly 500,000 customers, including the name and location of the service provider, where the customer received certain medical services, and codes associated with the diagnoses and procedures provided.

Medibank CEO David Koczkar said that while the attackers may have extracted all the data they had access to, the organization would not pay the ransom demand.

"Based on the extensive advice we received from cybercrime experts, we will not pay the ransom, as it is certain that our customer data will not be returned and will definitely remain published," said Koczkar as quoted by TechCrunch, Wednesday, November 9.

Koczkar added that paying hackers will again have another extortion tactic by trying to extort customers directly.

Following Koczkar's statement, the ransomware gang believed to be a rebrand of the defunct REvil group threatened to leak the stolen Medibank data via the dark web. Unfortunately, the gang did not say how much data it took from the Medibank network, and did not share evidence of its claim.