MediSecure, a leading Australian prescription supply service provider, announced that nearly 13 million people had their sensitive personal and health information compromised during a devastating April ransomware attack.
The corporation quickly responded by securing its website and cell phone lines to contain the attack, publicly disclosing it on May 16 as a “cyber security incident.”
In its time, the Australian Nationwide Cyber Safety Coordinator (NCSC) characterized the incident as a “massive-scale ransomware data breach” while assisting Medisecure in mitigating the compromise.
During its investigation into the ransomware attack, MediSecure found that the attackers had stolen approximately 6.5 terabytes of data, which was subsequently recovered from a server backup.
“On April 13, 2024, MediSecure became aware of an incident when it was discovered that a database server had been encrypted by suspected ransomware. By April 17, 2024, with the assistance of IT specialists, MediSecure quickly restored a comprehensive backup of the server and promptly took measures to investigate the affected data.”
Approximately 12.9 million Australians who used MediSecure’s prescription service between March 2019 and November 2023 are potentially affected by this incident, identified by their healthcare identifiers. Although we’ve made every effort to determine the exact number, the complexity of our data set means we’re unable to do so.
The private and well-being data compromised in this breach includes sensitive information such as names, birth dates, home addresses, phone numbers, email addresses, personal healthcare identifiers (IHI), Medicare card numbers, prescription medication details including the drug name, dosage, and quantity, and reasons for prescription and treatment directions.
The revised text is:
Pensioner Concession, Commonwealth Seniors, Healthcare Concession, and Department of Veterans’ Affairs (DVA) Gold, White, and Orange card numbers were also included.
The Australian Nationwide Cyber Safety Coordinator advises: “Be vigilant against scams exploiting the MediSecure data breach; refrain from responding to suspicious outreach referencing this incident.”
“If you’re approached by someone claiming to be a medical services provider, financial services provider, or any other type of service supplier who requests personal, financial, or banking information, hang up immediately and call back using an independent phone number you’ve sourced.”
Until 2023’s latter half, MediSecure stood as one of Australia’s two prominent prescription supply firms. However, its status shifted in that year with the emergence of Fred IT Group’s eRx Script Alternative (eRx), which ultimately succeeded it.
