Suspected ransomware encrypted a MediSecure database server, exposing health data of about 12.9 million Australians

What happened

MediSecure's official statement says the company became aware of the incident on 13 April 2024, when a database server was found to have been encrypted by suspected , and that it immediately acted to secure its IT environment ^[1].

The investigation indicated that about 6.5TB of data stored on the server was likely stolen by a malicious third party, but the encrypted server could not be examined to determine exactly what was accessed ^[1].

The company says the incident was first notified to the public on 16 May 2024 ^[1].

Who was affected

MediSecure confirms that approximately 12.9 million Australians who used its prescription delivery service from about March 2019 to November 2023 are affected; the stolen data included contact and health information such as names, dates of birth, email addresses, phone numbers, physical addresses, healthcare identifiers, Medicare and other government health-card numbers, and prescription details including the drug name, strength and reason for the prescription ^[1][2].

The statement also says MediSecure is no longer part of Australia's digital health network, and that people can continue to obtain medicines safely while healthcare providers can still prescribe and dispense through the current national prescription delivery service, eRx ^[1].

The NSW Government likewise says personal and health information relating to prescriptions for about 12.9 million individuals, as well as healthcare provider information, may have been exposed, and that the affected data relates to prescriptions distributed by MediSecure's systems up until November 2023 ^[2].