Full Report
Medibank suffered a data breach that compromised 9.7 million current and former customers.
Analysis Summary
# Incident Report: Medibank Customer Data Breach via Stolen Credentials
## Executive Summary
In November 2022, Medibank suffered a significant data breach affecting 9.7 million current and former customers after attackers gained internal network access using previously stolen high-ranking corporate credentials. The attackers successfully exfiltrated approximately 200 GB of sensitive customer data. Medibank managed to shut down ongoing data transfer backdoors, preventing a likely ransomware encryption event, but ultimately refused to pay the \$10 million ransom demand, leading to the public publishing of stolen data segments online.
## Incident Details
- Discovery Date: Not explicitly stated, but detected upon observing "unusual activity."
- Incident Date: Occurred sometime before November 11, 2022.
- Affected Organization: Medibank
- Sector: Private Health Insurance
- Geography: Australia
## Timeline of Events
### Initial Access
- Date/Time: Unknown prior to detection.
- Vector: Stolen high-ranking corporate credentials sold on a cybercriminal marketplace.
- Details: Attackers believed to be affiliated with the defunct REvil ransomware gang used these credentials to log into Medibank's network.
### Lateral Movement
- Details: Not detailed, but implied as necessary to access and exfiltrate the customer database.
### Data Exfiltration/Impact
- Details: Approximately 200 GB of customer data was stolen. The attackers later demanded a \$10 million USD ransom to prevent publishing the data, and subsequently began publishing segments online when the ransom was denied.
### Detection & Response
- Details: Medibank’s security team located and shut down two backdoors facilitating data transfer upon detecting unusual activity. This action likely stopped the attack from escalating into a ransomware encryption stage.
## Attack Methodology
- Initial Access: Compromise via stolen privileged corporate credentials.
- Persistence: Implied by the use of backdoors facilitating data transfer (which were later shut down).
- Privilege Escalation: Not detailed.
- Defense Evasion: Not detailed.
- Credential Access: Attackers initially possessed already compromised, high-ranking credentials.
- Discovery: Not detailed.
- Lateral Movement: Implied, required to reach the customer database.
- Collection: Customer database containing 9.7 million records.
- Exfiltration: Data transfer facilitated via existing backdoors, halted by security team.
- Impact: Major data theft and extortion attempt. The attack was stopped short of system encryption/ransomware deployment.
## Impact Assessment
- Financial: A \$10 million ransom was demanded (and refused). Actual costs related to remediation and reputational damage are not specified.
- Data Breach: 200 GB of customer data belonging to 9.7 million current and former customers was stolen. The nature of the data (sensitive) is implied by the context of a health insurer.
- Operational: The attack was largely contained before system encryption occurred, avoiding typical ransomware operational shutdown, although data loss occurred.
- Reputational: Significant negative impact, drawing comparisons to a recent, large breach at Optus.
## Indicators of Compromise
*Note: Specific IoCs were not provided in the summary, thus this section reflects the mechanisms.*
- Network indicators: Use of compromised high-ranking corporate credentials for network login.
- File indicators: N/A
- Behavioral indicators: Unusual network activity leading to detection; presence of data transfer backdoors.
## Response Actions
- Containment: Security team located and shut down two backdoors used for data transfer.
- Eradication: Not detailed, but necessary steps would follow remediation of compromised credentials and systems.
- Recovery: Not detailed.
## Lessons Learned
- Credentials remain a critical entry point, especially high-ranking corporate credentials.
- Quick detection and intervention (shutting down backdoors) successfully prevented a catastrophic ransomware encryption phase.
- Ransomware actors (or related affiliates, like REvil affiliation noted) are actively targeting organizations for data theft, even if primary encryption is thwarted.
## Recommendations
- Immediately review and enforce Multi-Factor Authentication (MFA) across all privileged and corporate accounts.
- Enhance monitoring for unusual network access patterns, especially those utilizing legitimate, high-privilege accounts.
- Conduct comprehensive audits on credential management originating from external marketplaces.