medibank.com.au Listed by revil Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 7 November 2022, medibank.com.au appeared on the leak site operated by the revil ransomware group. The group claims to have stolen internal data in a ransomware attack that involved the exfiltration of internal files. The number of people affected remains unknown, and public detail on the precise scope and method of the incident is limited.

The listing itself is a claim by the threat actors rather than an independently confirmed disclosure. For customers, staff and partners of a major health insurer, any assertion that internal material has left the organisation raises immediate questions about what was taken and how it might be misused.

Breaking down the breach

According to the available record, medibank.com.au was listed by revil on or around 7 November 2022. The group stated that it had conducted a ransomware attack and exfiltrated internal files. No further technical particulars—such as the initial access vector, the duration of unauthorised access, the volume of data removed, or any ransom demand—have been disclosed in the material provided. The number of individuals whose information may have been involved is recorded as unknown.

Because the primary public signal is the leak-site listing, the incident is best understood at this stage as an unverified claim of data theft accompanying a ransomware operation. Organisations named in this way sometimes later confirm or dispute the claims; in the absence of such confirmation here, the facts stop at the listing and the group’s assertion that internal files were taken.

The group behind it: revil

REvil, also known as Sodinokibi, was a prominent ransomware-as-a-service operation that was active for several years before law-enforcement actions disrupted its infrastructure. The group typically gained access to corporate networks, encrypted systems, and exfiltrated data before issuing ransom demands. Its business model relied on affiliates who conducted intrusions and shared proceeds with the core operators.

REvil was known for double-extortion tactics: threatening to publish stolen data on a dedicated leak site if payment was not made. The group previously claimed responsibility for high-profile attacks against organisations in multiple sectors and countries. In this case, the appearance of medibank.com.au on that leak site constitutes the group’s claim that it stole internal data; no additional statements specific to this victim beyond that claim are recorded in the facts.

medibank.com.au and its sector

Medibank is one of Australia’s largest private health insurers, providing hospital and extras cover to millions of customers and also operating related health services. Organisations of this type routinely hold extensive personal, financial and health-related information, including membership details, claims histories, medical identifiers and payment data, as well as internal corporate records.

A breach affecting a health insurer is consequential because the data such entities possess is both sensitive and long-lived. Health information cannot be changed like a password, and its exposure can create lasting privacy and fraud risks. Even when only “internal files” are named, the potential overlap with customer or clinical material makes the incident material to the broader healthcare and insurance sector.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as customer databases, claims records, employee files or specific document types—has been publicly detailed in the provided record. Exact contents therefore remain unconfirmed.

Health insurers and related providers typically maintain large repositories of personally identifiable information, policy and claims data, clinical or treatment-related notes, billing and payment details, and internal operational documents. Until a fuller accounting is released, it is not possible to state which of these categories, if any, were included in the material the group claims to have taken. The prudent working assumption for anyone associated with the organisation is that sensitive internal material may have left its control, while recognising that the precise composition is still undisclosed.

Why it matters

For individuals, the core risk is that personal or health-related information could be used for identity fraud, targeted phishing, or other social-engineering attacks. Even limited internal documents can contain enough context—names, membership numbers, dates of service or contact details—to make subsequent scams more convincing. Because health data is inherently sensitive, any exposure can also carry reputational and emotional consequences that outlast the immediate incident.

For the organisation, a claimed ransomware intrusion and data exfiltration raises operational, regulatory and trust issues. Australian entities handling health information are subject to privacy and data-protection obligations; an incident of this nature typically triggers internal investigation, possible notification duties, and scrutiny from regulators and customers. The absence of confirmed numbers of affected people does not reduce the need for careful assessment of what left the network and who may need to be informed.

Were you affected?

If you are a current or former Medibank customer, employee or partner, treat the claim seriously until more definitive information appears. Monitor account statements and health-insurance correspondence for unusual activity, be cautious of unexpected emails or calls that reference your policy or personal details, and consider placing fraud alerts with relevant credit-reporting bodies if you believe your identity data may be involved. Enable multi-factor authentication on related online accounts where it is available.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step provides one practical indicator of wider exposure and can help you decide what further monitoring or credential changes are warranted.

AICompiled with AI assistance from public sources and published under our editorial standards.