Frequently asked questions

Through continuing investigation and analysis, we believe the data the criminal has accessed and stolen has been released on the dark web.

If your data was accessed or stolen, you should have received a letter from us detailing what types of data were impacted and what support and advice we are providing.

Remain vigilant with any communications you receive (email, text, phone calls).

If you need any advice, we have engaged IDCare who can provide you with identity protection support and guidance.

If a person contacts you threatening to release your data unless payment is made, please report this immediately to ReportCyber via their website or on 1300 292 371.

If you receive any suspicious emails to texts that may be scams, you can report them to ScamWatch. ScamWatch provides information about what scams may look like and types of scams.

If your data was accessed or stolen, you should have received a letter from us detailing what types of data were impacted and what support and advice we are providing.

If your data was accessed or stolen, you should have received a letter from us detailing what types of data were impacted and what support and advice we are providing.
 

AFP Commissioner Reece Kershaw made the following statement:

“The AFP believes that those responsible for this cybercrime are in Russia and it will be holding talks with Russian law enforcement about the individuals believed to be involved."

Read more here.

Customers should remain vigilant.

There are a number of resources online which you can find on Staying Safe Online.

We will continue to support all people who have been impacted by this crime through our Cyber Response Support Program, which includes mental health and wellbeing support, identity protection and financial hardship measures. 

Medibank experienced a cyber breach in October 2022. The criminal has released files on a dark web forum in December 2022, containing customer data believed to have been stolen from our systems. We recognise the distress this may cause you and we apologise.

The Australian Federal Police put in place a program to help protect Medibank customers whose personal information has been unlawfully released online. They have been actively monitoring the clear, dark and deep web for the sale and distribution of Medibank data. Blackmail is an offence and those who misuse stolen personal information for financial gain face a penalty of up to 10 years’ imprisonment. Law enforcement is committed to taking swift action against anyone attempting to benefit, exploit or commit criminal offences using stolen Medibank data.

If a person contacts you online, by phone or by SMS threatening to release your data unless payment is made, please report this through ReportCyber online or by calling 1300 292 371.

You can change your address, email, password, phone number and payment details quickly and easily using the My Medibank app.

We’ve developed helpful guides on how to:

• Log in to My Medibank
• Change your login details
  
• Change your contact details
• Change your payment method and
• Register for My Medibank

If you received a scam email or SMS, do not click on any links. To report a scam, please visit Scamwatch.

There are a number of resources online which you can find on Staying Safe Online

Remember, Medibank will never contact you to demand money, ask for your password or sensitive information, or attempt to call you outside of business hours unless by prior arrangement.

At Medibank we use a number of different platforms and email addresses to send through our communications.

Please give close consideration to the sender of any communications you receive. 

We will never contact you to demand money, ask for your password or sensitive information, or attempt to call you outside of business hours unless by prior arrangement. If you receive any suspicious emails or texts, you can report them at Scamwatch.

We have also developed helpful resources and advice on protecting your information and being vigilant to scams.

We believe that membership numbers have been accessed or stolen by the criminal.

Rest assured that if you are impacted by this, it will not affect your ability to use your cover.

We are not currently recommending that you need a new membership number.

There are some proactive steps you can take to protect yourself. It is important to remain vigilant with your online security. We encourage customers to review the advice of:

• The Federal Government factsheet which has been developed for affected Medibank customers.
• The Australian Cyber Security Centre (ACSC).

We have also developed helpful resources and advice on protecting your information and being vigilant to scams.

Normal business operations have been maintained for Medibank customers during the event with customers continuing to access health services. No further suspicious activity inside our systems has been detected since 12 October 2022.

Medibank has prioritised preventing unauthorised entry to its IT network and is continuing to monitor for any further suspicious activity. This has included bolstering existing monitoring, adding further detection and forensics capability across Medibank’s systems and network and scaling up analytical support via specialist third parties.

Our dedicated Cyber Response Support Program for our current and former customers and providers includes:

• A cybercrime health & wellbeing line (1800 644 325) – counsellors that have experience supporting vulnerable people (such as those at risk of domestic violence) and have been trained to support victims of crime and issues related to sensitive health information.
• Better Minds App – new tailored preventative health advice and resources specific to cybercrime and its impact on mental health and wellbeing, including tools for managing anxiety and fear, with additional phone based psychological support available.

• Hardship support for customers who are in a uniquely vulnerable position as a result of this crime which can be accessed via our contact centre team (13 23 31 for Medibank and international customers, or 13 42 46 for ahm customers).
• Specialist identity protection advice and resources through IDCARE’s purpose-built Medibank page.
• Free identity monitoring services for customers whose identity has been compromised as a result of this crime.
• Reimbursement of ID replacement fees for customers who need to replace any identity documents that have been compromised as a result of this crime.

Reach out for support

If you’re feeling distressed or anxious, please reach out. Along with calling the cybercrime health & wellbeing line, you can contact your GP or the following support services:

• Beyond Blue (1300 224 636 / beyondblue.org.au)

• Lifeline (13 11 14 / lifeline.org.au)

If there is an imminent threat to your safety call Triple Zero.

There has not been any impact for Medibank customers accessing health services. Normal business operations have been maintained during this cyber incident.

Medibank is required by law to retain certain customer (including former customer) information for particular periods of time, generally for 7 years from when a customer leaves us, but in some instances longer.

Our former and current customers can access our dedicated Cyber Response Support Program, which includes:

• A cybercrime health & wellbeing line (1800 644 325) – counsellors that have experience supporting vulnerable people (such as those at risk of domestic violence) and have been trained to support victims of crime and issues related to sensitive health information.
• Better Minds App – new tailored preventative health advice and resources specific to cybercrime and its impact on mental health and wellbeing, including tools for managing anxiety and fear, with additional phone based psychological support available.

• Hardship support for customers who are in a uniquely vulnerable position as a result of this crime which can be accessed via our contact centre team (13 23 31 for Medibank and international customers, or 13 42 46 for ahm customers).
• Specialist identity protection advice and resources through IDCARE’s purpose-built Medibank page.
• Free identity monitoring services for customers whose identity has been compromised as a result of this crime.
• Reimbursement of ID replacement fees for customers who need to replace any identity documents that have been compromised as a result of this crime.

Reach out for support

If you’re feeling distressed or anxious, please reach out. Along with calling the cybercrime health & wellbeing line, you can contact your GP or the following support services:

• Beyond Blue (1300 224 636 / beyondblue.org.au)

• Lifeline (13 11 14 / lifeline.org.au)

If there is an imminent threat to your safety call Triple Zero.