Cyber Incident Victim: Medicare
Date:
Oct 2016
Location:
Australia
Summary
A darknet vendor exploited a vulnerability in a government system to illegally access and sell Medicare patient details of Australians, advertising the service as 'the Medicare machine'. The seller offered real-time access to sensitive records, confirmed through verification by a media outlet, and had sold at least 75 individuals' data for identity fraud purposes, including creating counterfeit cards for financial crimes. The breach posed significant risks to health agencies, with the vendor claiming to leverage a security flaw while authorities investigated potential involvement of organized crime groups using darknet markets to evade detection.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In October 2016, a darknet vendor began illegally offering Medicare patient details of any Australian citizen upon request, branding the service "the Medicare machine" and using an Australian Department of Human Services logo to advertise. The seller exploited an unidentified vulnerability in a government system to access real-time records, enabling the sale of sensitive healthcare information. By July 2017, the vendor had sold at least 75 individuals' Medicare card details at a price of 0.0089 bitcoin (approximately US$22) per record. Guardian Australia verified the operation's authenticity by successfully purchasing a staff member's personal Medicare details through the service. The vendor described their activities as "traditional criminal activity" and expressed intent to compile a "mass batch" of data requests, though the exact technical method of extraction remained unconfirmed. Organized crime groups were identified as primary beneficiaries, using darknet markets to evade law enforcement while acquiring data valuable for identity fraud schemes.
The compromised Medicare details created significant risks for identity theft, including the production of counterfeit Medicare cards to fraudulently obtain goods or lease properties. The breach implicated potential vulnerabilities across multiple government entities, with speculation about involvement of Australian federal police systems, the Department of Health infrastructure, or external cybercriminal networks. The Department of Human Services acknowledged the incident and confirmed active investigations but did not disclose remediation measures or system modifications. Criminal actors leveraged the darknet's anonymity to conduct auctions for bulk data purchases, complicating detection efforts. The incident demonstrated how healthcare data breaches could directly enable financial crimes while exposing systemic security weaknesses in critical government infrastructure.