What happened
According to the OAIC’s alleged timeline, an attacker logged in to Medibank’s VPN around 23 August 2022 and exfiltrated data from around 25 August to 13 October 2022 [oaic-medibank-timeline]. In October 2022 Medibank disclosed a cyber attack and data-theft extortion exposing the personal information of around 9.7 million current and former customers, including health claims data for a subset [oaic-medibank], [oaic-medibank-overview]. Some of the stolen data was later published on the dark web [oaic-medibank]. In June 2024 the OAIC commenced civil penalty proceedings in the Federal Court, alleging Medibank failed to take reasonable steps to protect personal information [oaic-medibank].
Timeline
- 2022-08 — Initial VPN access around 23 August 2022, and exfiltration from around 25 August, as alleged by the OAIC [oaic-medibank-timeline].
- 2022-10 — Medibank disclosed the breach; approx 9.7M people affected [oaic-medibank].
- 2024-06 — OAIC commenced civil penalty proceedings in the Federal Court [oaic-medibank].
Current status
Before the Federal Court; allegations not yet determined, no penalty ordered. [oaic-medibank]
Why it matters
The exposure of sensitive health information — not just identity data — made this a landmark case for the health sector. Figures and allegations are as stated by the regulator.