INCIDENT REPORT · CP-2022-004
Medibank customer data breach
L3 · ELEVATEDCONFIRMED
Australian health insurer Medibank detected unusual network activity in October 2022. A criminal actor later said it had stolen customer data and demanded payment.
- Incident ID
- CP-2022-004
- Disclosure date
- 13 OCT 2022
- Detection date
- 12 OCT 2022
- Affected countries
- Australia
- Plotted location
- Melbourne, Australia (Affected organization headquarters)
- Threat classification
- Level 3 — ELEVATED
- Classification rationale
- Theft and leak of sensitive health data on millions of customers of a major insurer.
- Attack type
- Data Breach
- Nature
- Malicious activity
- Attack vector
- Not publicly documented
- Sectors
- Healthcare, Finance
- Critical infrastructure
- No
- Organizations affected
- Medibank Private (including ahm)
- Operational consequences
- Personal data on about 9.7 million current and former customers was accessed, including health claims data. Stolen records were published online after Medibank declined to pay.
- Estimated financial impact
- No reliably documented figure
- Attribution (as stated)
- Attributed by the Australian government (January 2024 cyber sanctions, with the UK and US following) to Russian national Aleksandr Ermakov; reporting links him to the REvil ransomware group
SOURCE REFERENCES
- [1] Cyber sanctions in response to Medibank Private cyber attackAustralian Minister for Foreign Affairs · foreignminister.gov.au · 23 JAN 2024
- [2] Medibank cyber incident and trading updateMedibank · medibank.com.au
- [3] UK, US and Australia sanction Russian Aleksandr Ermakov over Medibank hackThe Record · therecord.media
RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.