What happened
In April–May 2024 MediSecure, a national electronic-prescriptions provider, suffered a cyber attack. In July 2024 MediSecure confirmed that the personal and health information of around 12.9 million Australians had been affected — including names, dates of birth, contact details, healthcare identifiers, Medicare and concession card numbers, medication details and reasons for prescription [ms-acs]. The company entered administration on 3 June 2024 and later liquidation [oaic-medisecure].
Timeline
- 2024-04 — Cyber attack on MediSecure’s systems [oaic-medisecure].
- 2024-05 — Public disclosure of the incident [oaic-medisecure].
- 2024-06-03 — MediSecure entered administration, later moving to liquidation (FTI Consulting) [oaic-medisecure].
- 2024-07 — MediSecure confirmed ~12.9M Australians affected [ms-acs].
- 2024-09-13 — The OAIC closed its inquiries and said it would not pursue an investigation [oaic-medisecure].
Current status
MediSecure entered administration on 3 June 2024 and later liquidation (FTI Consulting). On 13 September 2024 the OAIC closed its inquiries and said it would not pursue an investigation [oaic-medisecure].
Why it matters
One of the largest breaches in Australian history by number of people, and a stark example of a critical health-infrastructure provider collapsing after an attack.