This article was first posted on 27 October 2022
Update 10 November 2022
The headlines say it all:
Medibank: Data stolen from Australia health insurance available online – BBC News
These criminals will have no compassion. Medibank should have had better cyber security.
Update 7 November 2022
Is it second nature for insurance companies to refuse to pay?
Medibank, the Australian health insurance company that due to poor cyber security allowed threat actors to access some very personally indefinable information client information, is refusing to pay to keep the data out of the public domain.
Breached health insurer won’t pay ransom to save customers • The Register
Unfortunately in this case not paying is the right thing to do!
Original Post 27 October 2022
There has been a number of high-profile cyber security incidents in Australia over the past months, that have a had a real impact on the citizens. The Australian health insurer Medibank and the second-largest telecommunications company Optus were the biggest companies that could not protect their information. The Optus attack compromised the personal information of around 10 million Australians, or about 40% of the population.
Now the Australian government is going to take action with new legislation:
What you should take away from this is, whatever you think of GDPR, the EU, Brexit etc., you as an organisation need to be in charge of your information and those who have legitimate access to that information. You may not make the headlines if you leak that data, but you will still have to notify the ICO and your customers and suppliers.
Not sure where to start? You thought GDPR was all done… You paid someone to do it for you a few years back… My advice is have a look at this article I wrote and then think about the “principle of least privilege”.
Why you should care about the TLA AAA! – CyberAwake
Clive Catton MSc (Cyber Security) – by-line and other articles
Further Reading
UKGDPR posts at Smart Thinking Solutions
Medibank now says hackers accessed all its customers’ personal data (bleepingcomputer.com)
