Medibank breach via contractor credentials on VPN without MFA

An IT service desk operator at a Medibank contractor had saved his Medibank usernames and passwords in a browser profile on his personal computer; the OAIC alleges an attacker used those credentials to log into Medibank's GlobalProtect VPN, which did not require MFA. The attacker exfiltrated data on about 9.7 million people and later published it on the dark web. Medibank disclosed a cyber incident on October 13, 2022.

Victim

Medibank Private

Industry

Insurance

Country

Australia

Intrusion began

Aug 2022

First disclosed

Oct 13, 2022

Actor

Aleksandr Ermakov (REvil-linked, sanctioned) (Extortion group)

Initial access

Stolen credentials

Identity control that failed

Authentication

MFA

Not enforced on the abused account

Abused identity

Human account

Records affected

9.7 million (About 9.7 million current and former customers and representatives, per the OAIC and U.S. Treasury.)

Disclosed cost

Medibank reported non-recurring cybercrime costs of A$46.4 million in FY23 and A$39.8 million in FY24 (AUD, not converted), per iTnews.