Medibank 2022: The Ransom Refusal That Published Patients

Quick Answer — In October 2022, Australian health insurer Medibank discovered criminals had exfiltrated data on ~9.7 million customers after entering via a contractor’s compromised VPN credentials on a gateway without MFA. Medibank refused to pay the ransom. The criminals retaliated by publishing customers’ abortion records, addiction-treatment data, and mental-health diagnoses in staged dumps. The lesson: refusing ransom is a valid strategy only if you’ve already accepted the publish — and contractor access without phishing-resistant MFA is your breach, wearing someone else’s logo. (Note: this article covers a security event; see web vulnerability primers for background.)

What happened

Per Medibank’s exchange filings, the Australian Government’s later review, and contemporaneous reporting:

• Entry. A criminal group (later attributed by Australian authorities to the Russia-linked “REvil”-affiliated operator using the persona “cyberport86” per official statements — hedge as per reporting) obtained credentials for a third-party IT contractor and logged into Medibank’s network over a VPN that lacked MFA. Privilege escalation followed; the actor roamed for weeks.
• The demand. After exfiltrating ~9.7 million customers’ records, the actor demanded $9.7M ($1 per record, in the era’s dark poetry). Medibank’s board, advised that payment was no guarantee and criminal besides, refused.
• The retaliation. The criminal dumped data in stages on a leak site, sorted cruelest-first: abortion records, addiction and mental-health treatment flags, then broader PII. The dumps were “deliberately vexatious” per Medibank’s own description — engineered to maximize harm and pressure.
• The aftermath. Australian Federal Police investigated; the Australian Signal Directorate’s review exposed the security failures (no MFA on VPN, contractor sprawl, poor segmentation); the privacy-regulator lawsuit followed; the government’s response reshaped its ransom-payment posture debate. Estimated remediation costs eventually ran past AU$126M.

Impact and numbers

Why refusing the ransom was the headline — and the trap

The publish decision created a new canonical text for ransom strategy. Payment would have funded crime and, per every credible study, guaranteed nothing — the data stays stolen regardless. Refusal invited the cruelest possible publication, exacted on the customers least able to shrug: patients whose sensitive care histories became search-engine content. Boards worldwide updated their playbooks: ransom refusal is defensible, but only alongside (a) pre-decided publish-response comms, (b) legal/regulator alignment, and (c) support infrastructure for the humans whose data walks. Medibank did all three — the dumps still hurt. The durable lesson: by exfiltration day, every option is bad; the real decisions were made years earlier, at MFA-procurement time.

Timeline

Why it still matters in 2026

Because every element aged into doctrine. Contractor access without phishing-resistant MFA is now an audit finding everywhere, not a choice. Health data segmentation — keeping sensitive-care flags out of lazily-joined warehouses — became a healthcare-architecture requirement. And the “refuse-and-publish” playbook Medibank endured is now formal guidance in several jurisdictions (Australia’s 2024 ransom-reporting debates cite it by name). The breach also motivated the “exclusive” costs line item boards now demand: breach costs are not the fine, they’re the years of credit-monitoring, specialist support lines, and re-architecture. When a 2026 board asks “why are we spending millions on MFA for contractors,” Medibank is the one-word answer.

The intrusion, in one diagram

 criminal creds shop
         |
  contractor VPN account
  (no MFA on gateway)
         |
  Medibank network entry
         |
  privilege escalation
  (weeks of roaming)
         |
  exfil 9.7M records
         |
  demand: $9.7M ── refused
         |
  staged cruel dumps
  (abortion, addiction,
   mental-health first)

 defense happened (or
 didn't) years earlier:
 MFA, segmentation,
 contractor tiering

Detection and hardening takeaways

• Phishing-resistant MFA on every VPN. Contractor accounts included; FIDO2/WebAuthn kills the credential-shop supply.
• Tier contractor access. Third-party accounts get narrow roles, short windows, and named sponsors — never ambient network citizenship.
• Segment health data. Sensitive-care flags live in separate stores with separate access; a roaming intruder should meet walls, not warehouses.
• Hunt for the roaming weeks. Medibank’s intruder lingered; detection maturity means anomalous internal reconnaissance pages someone before exfil begins.
• Pre-decide the ransom question. Boards should decide payment posture in peacetime, with legal and regulator alignment — not under a leak-site countdown.

Did refusing the ransom make things worse?

The data was exfiltrated before the demand arrived; payment could not re-capture it. What payment might have bought was silence — with criminal guarantees worth nothing, and funding the next attack. What refusal bought was the dumps. This is why the modern framing treats the ransom decision as tragic either way, and relocates the real leverage to prevention: the decisions that mattered were MFA, segmentation, and contractor governance, all made before the criminal logged in.

Who was behind it?

Australian authorities and reporting attributed the intrusion to a Russia-linked criminal actor; per official statements and court filings, the individual behind the persona was later sanctioned and charged in absentia (announced 2023-2024 era). Hedge appropriately when citing: “attributed by Australian authorities to a Russia-linked actor” is the defensible line; persona names beyond the official record shift with the reporting.

What happened to the victims’ data?

It stays published — that is the brutal mathematics of exfiltration. Medibank funded support programs, specialist mental-health lines, and replacement-document handling, but the records on the leak site remain outside any recall. That irreversibility is why exfiltration-resistant architecture (encryption whose keys the network posture protects, minimal retention, sensitive-field tiering) outranks detection/response in the current healthcare security hierarchy.

Part of the hmmnm.com security-timeline series — one event per month, 2021–2024, indexed here.

Published by Hmmnm

Hands-on cybersecurity tutorials, CVE breakdowns, and guided learning paths — written and lab-tested by the Hmmnm team.

Learning Paths · About Hmmnm · Editorial policy