The ePrescription company first became aware of a breach on April 13 when suspected ransomware was discovered in a database server that contained personal and health information before publicly confirming the cyber attack in May.
MediSecure on Thursday revealed about 12.9 million Australians who used the company's prescription delivery service from March 2019 to November 2023 were impacted after their data stolen by a malicious third-party actor.
This afternoon MediSecure and its administrators have publicly advised that the company has ceased its investigation into the cyber incident that impacted the company earlier this year.— National Cyber Security Coordinator (@AUCyberSecCoord) MediSecure advised that the personal and sensitive information, including contact and health… pic.twitter.com/NJfOptZO71July 18, 2024
Included in the 6.5 terabyte of data stolen included names, dates of birth, addresses, phone numbers, Medicare numbers, prescription Information and the reasons for the medication.
The company is reviewing a data set of personal information which has been exposed on the dark web to identify and notify those impacted.
The federal government was not aware of publication of the full data set, National Cyber Security Coordinator Lieutenant General Michelle McGuinness said on X, formerly Twitter.
"No one should go looking for or access stolen sensitive or personal information from the dark web," Lt McGinness said on Thursday.
"This activity only feeds the business model of cyber criminals and can be a criminal offence.
"I understand many Australians will be concerned about the scale of this breach. I encourage everyone, whether impacted in this incident or not, to be alert to being targeted in scams."
MediSecure was one of two ePrescription delivery services until late 2023 with the Australian government awarded the service exclusively to another company, Fred IT Group's eRx Script Exchange.
The company appointed liquidators and went into administration in June and is not part of Australia's digital health network.
The national prescription delivery service, eRx, is not affected by this cyber incident, the government confirmed.
"Consumers can continue to access medicines safely, and healthcare providers can still prescribe and dispense as usual," it said.
