Australia’s federal police chief has put the Russian hackers behind the Medibank data breach on notice, warning they face extradition.
Commissioner Reece Kershaw confirmed on Friday afternoon a network of Russian criminals was behind the cyber attack on Australia’s largest health insurer Medibank.
Mr Kershaw had a blunt message for the people responsible for the hack.
“We know who you are,” he said.
“The AFP has some significant runs on the scoreboard when it comes to bringing overseas offenders back to Australia to face the justice system.”
Mr Kershaw said the crime had the potential to impact millions of Australians and damage a significant Australian business.
“This cyber attack is an unacceptable attack on Australia and it deserves a response that matches the malicious and far-reaching consequences that this crime is causing,” he said.
Mr Kershaw said talks would be held with Russian law enforcement about the individuals involved, who were known but would not be publicly named at this stage.
He emphasised Russia benefited from the intelligence sharing through Interpol “and with that comes responsibilities and accountabilities”.
Opposition cyber security spokesman James Paterson said the disclosure opened up the possibility of sanctions under Australia’s Magnitsky regime.
The regime, passed with bipartisan support in December 2021, enables the imposition of targeted financial sanctions and travel bans in response to serious corruption and significant cyber incidents.
Prime Minister Anthony Albanese earlier told reporters he was “disgusted by the perpetrators of this criminal act”, and he authorised the AFP boss to disclose the information.
The hackers have since released more sensitive details of customers’ medical records on the dark web, including data on abortions and alcohol issues.
It follows Medibank’s refusal to pay a ransom for the data, with almost 500,000 health claims stolen, along with personal information.
Medibank has created a one-stop shop of mental health and other support services that can be accessed by affected customers via its website.
© AAP 2022
