Medibank Breach: 9.7 Million Records and Cyber Sanctions

When a health insurer is breached, the stolen details include things nobody can change. This Australian case ended with sanctions on an individual, but no arrest.

By Siddharth ShankarUpdated October 11, 2026

Health insurance records connect a name to a body: claims, diagnoses and treatments. When that data is stolen and published, the harm is personal in a way a leaked password is not.

What happened

According to the Australian Foreign Minister's release, 9.7 million records were stolen from Medibank. The attack took place in October 2022, per The Record. The data included names, dates of birth, Medicare numbers and sensitive medical information, and some of the stolen records were published on the dark web.

On January 23, 2024, Australia announced sanctions against a Russian national, using its autonomous cyber sanctions framework for the first time. The measures were a targeted financial sanction and a travel ban. The attack was investigated under Operation Aquila by the Australian Signals Directorate and the AFP.

How it worked

The Foreign Minister's release describes a cyber attack involving data theft and references ransomware payments. It does not describe the intrusion method, and we do not guess. The government advised not to pay ransoms, and it noted that dealing with the sanctioned person's assets, including through ransomware payments, is an offense carrying up to 10 years' imprisonment.

Publishing stolen records is a pressure tactic. When a victim refuses to pay, the criminals release the data to show they are serious and to harm the company's reputation, with ordinary people caught in the middle.

What was exposed

The categories listed are names, dates of birth, Medicare numbers and sensitive medical information. Medicare numbers are government identifiers, and medical information is permanent. Neither can be reissued like a card number.

For affected people, the dark web publication means the data could circulate widely.

How it ended

This is an unhappy ending. Sanctions are a significant diplomatic step, but they are not an arrest or a conviction, and the sanctioned person is not in custody. The Foreign Minister's release does not describe compensation for those affected.

A timeline of the case

The attack took place in October 2022, according to The Record. Some of the stolen records were later published on the dark web. On January 23, 2024, about fifteen months after the attack, the Australian Government announced sanctions, and the attack had been investigated under Operation Aquila by the Australian Signals Directorate and the AFP.

The gap is typical for cross-border cyber cases. Attribution takes time, and a public naming is often the first formal step, not the last.

Key facts at a glance

• Records stolen: 9.7 million, according to the Australian Government
• Data types: names, dates of birth, Medicare numbers, sensitive medical information
• Published: some records were put on the dark web
• Sanctions announced: January 23, 2024
• Measures: a targeted financial sanction and a travel ban
• Penalty for dealing with the person's assets: up to 10 years' imprisonment

Why this case matters

Cases like Medibank show a limit of criminal justice: when attackers are overseas, prosecution may not be possible. Sanctions are used as a substitute that increases the cost of the crime, but they do not return the data.

For individuals, health-related information can be used to build targeted scams for years. A caller who mentions a real claim or procedure sounds credible.

What you can do

What sanctions can and cannot do

A targeted financial sanction and a travel ban make it harder for a person to use banks or travel to countries that enforce the measures. They also make it an offense for others to deal with the person's assets, including by paying a ransom. That affects victims and their advisers.

What sanctions cannot do is recover data or compensate victims. For that reason the practical protection for individuals is still their own: unique passwords, caution with health-themed contacts and regular checks of their credit and government accounts.

What the release does not say

The release does not say how the attackers got in or how the data was found by criminals afterward. For another Australian health-data case with a court penalty, see Australian Clinical Labs.

If this case made you want to check your own position, start with these guides on how data breaches happen, how to tell a real breach notice from a phishing message and what each type of breached data means. You can also try our free email exposure check.