Back to the archive
Incident file · 2022
Medibank
Healthcare insurance · Australia · Threat actor: REvil-linked extortion crew
Data breach
Ransom refused
- US$10.0m
- Ransom demanded
- No
- Ransom paid
- 4 days
- Estimated downtime
- US$55m
- Est. revenue lost
What happened
Stolen credentials from a third-party contractor gave attackers access to customer health claims data, which was later leaked on the dark web after the ransom was refused.
How it ended
Publicly refused to pay, absorbed remediation costs above A$80m and faced an OAIC civil penalty action.
Data affected
9.7 million customers
Would your business survive this incident?
We stress-test detection, response and recovery so a ransom demand is never your only option.