An Australian journalist has purchased his own Medicare details on the dark web for the bitcoin equivalent of $29, suggesting a critical information security breach within an Australian government department.
Guardian Australia’s Paul Farrell bought his Medicare details from a seller who advertises their system as the Medicare Machine. Worryingly, he was able to verify the details provided as totally authentic.
Farrell writes the vendor has sold at least 75 similar information caches since October 2016, and that the wording of his advertisement – including the phrase “exploiting a vulnerability” – suggests the seller is able to extract this information contemporaneously, and at will.
To give you an idea of how brazen the information breach appears to be, cop this from Farrell:
It’s not currently clear how the information was gathered.
That’s massively concerning. The vendor advertises “Medicare patient details in full”, which could provide criminals with ample information to commit identity fraud. Take a minute to contemplate how many vital services you’ve signed up for with your Medicare deets – and realise it’s possible someone could be doing that, pretending to be you.
That’s not even entertaining the possibility that the vendor has access to the individual instances that the card has been used, which could outline an individual’s medical history.
Farrell noted that Guardian Australia informed the Department of Human Services, which oversees Medicare, of the breach prior to publication. It also informed the Department of Health, the federal police, and the federal information commissioner.
The Department of Human Services didn’t comment on this specific instance, but did tell Guardian Australia it was working with other government bodies to crack down on the very, very illegal sale of Medicare details.
If you believe you’ve been the victim of identity theft, follow the steps provided by the government’s
ACORN initiative, right
HERE.
