Govt downplays sale of Medicare card data on dark web

But refers matter to AFP.

The federal government minister in charge of Australia’s Medicare program has sought to downplay security concerns around Medicare card data being stolen and sold online.

The Guardian this morning revealed that personal Medicare details were on offer for less than $30 each on a dark web site known for trading illegal products.

It reported that the trader was able to access the data “on request” by exploiting a vulnerability on a government system.

The so-called “Medicare Machine” asks for 0.0089 bitcoin – or around A$29 – per record, and has reportedly sold around 75 individual records so far.

iTnews has confirmed the legitimacy of the Guardian report.

The data is of interest to criminals who could use it to defraud the government of Medicare rebates, or use the card data as part of 100 ID point checks.

But Human Services minister Alan Tudge downplayed the privacy breach, pointing out that health record details were not accessible.

“The only information claimed to be supplied was the Medicare card number,” Tudge said in a statement.

The department has regardless referred the matter to the Australian Federal Police.

Tudge did not comment further on the specific claims, saying only that the government was committed to cyber security as a priority and investigation on dark web activities occured continually.

In contrast, assistant minister to the treasurer, Michael Sukkar, told Sky News this morning the report was “extremely concerning”,

“We take extraordinarily seriously the data that we hold … in order to service

View the Original article

Govt blames Medicare card breach on ‘traditional’ crims

Not wide-scale, and no IT breach, says minister.

The federal government says there has been no breach of the Department of Human Services’ IT systems and the Medicare card data currently on sale likely affects only a small number of people.

Human Services minister Alan Tudge today made the comments despite the dark web vendor of the Medicare information claiming to have access to any Australian’s Medicare card.

The Guardian revealed today that an unknown individual was offering the details for around A$29 per file.

The online sale – confirmed by iTnews – claims the “Medicare patient details … of any Australian citizen” can be accessed for A$29 and the person’s first and last name and date of birth.

“Details provided include Medicare number, IRN and expiry date,” the listing states.

The vendor also promised to soon offer “mass batch requesting of details” via CSV file. He/she claims to have accessed the details through a vulnerability with a “solid foundation”. 

The federal government today sought to downplay the impact of the security breach, arguing health records had not been affected.

In a press conference on Tuesday afternoon, Human Services Minister Alan Tudge said there was “no indication there has been a wide-scale breach”.

“The suggestions are the numbers are very small and we are talking about the acquisition of Medicare card numbers only,” Tudge said.

“Nobody’s health records can be obtained just with a Medicare card number.”

He said DHS had informed him there had been no breach of its systems.

“It is more likely to have been a traditional criminal activity,” he said.

He did not elaborate. It is likely the minister is referring to traditional fraud activities like card skimming or the compromise of an individual with privileged access to data.

The listing for the Medicare card records was still active online at the time of writing.

Third party breach?

The information the vendor asks for in return for a Medicare number – full name and date of birth – is the same data required for a search on Human Services’ HPOS Medicare verification service for healthcare providers.

“When a Medicare card number is unavailable, you can enter personal information such as surname, first name and date of birth for the patient,” its website states. These are the only mandatory search fields.

It will return a Medicare card number, individual reference number (IRN), and first name – the same data the vendor promises to supply after payment.

While the government claimed that the breach had not impacted health records, a 2015 privacy impact assessment on the then-named PCEHR e-health records opt-out scheme shows records can be accessed with the above combined data.

The 2015 privacy assessment (archived) on the now-named My Health Record program shows an individual’s record can be accessed by a healthcare provider with their full name, date of birth, gender and Medicare card number.

Privacy expert Anna Johnston of Salinger Privacy, who worked on the assessment, said the addition of the Medicare card number was intended to stop healthcare workers trawling through the system to look up people who weren’t their patients.

“But if all that is needed to find out someone’s Medicare number (whether unlawfully through a data breach, or by design through the health provider portal) is their full name and date of birth, then to me this seems to undermine one of the ways that privacy risks were supposed to be minimised in the design of the My Health Record system,” she told iTnews.

She noted that while the impact of this type of abuse of the system would currently be limited given the MyHR system is in the early stages of transitioning to opt-out, it would quickly have much wider implications as the rollout scales.

“

View the Original article

Medicare cards likely nabbed through access compromise: Tudge

Confidential briefing given to peak doctors body.

The anonymous vendor selling Medicare card data on the dark web likely obtained the details through a compromise of legitimate access credentials, Human Services minister Alan Tudge has indicated.

The Guardian yesterday revealed that an unknown individual was offering any Australian’s Medicare card data for around A$29 per file, once the target’s full name and date of birth are provided.

The vendor claims to have exploited a “vulnerability

View the Original article

Medicare access to be reviewed after breach discovery

System hasn’t been changed in eight years.

The federal government has ordered a review of the way heathcare providers access Medicare card numbers following the revelation that the details were being sold online.

Last week The Guardian revealed Medicare card data for any Australian was being offered on the dark web for around A$29 per file.

The manner in which the data was being sold led to the presumption that the unknown individual was exploiting legitimate access to obtain the details.

Alongside payment, the seller requested a target’s full name and date of birth – the same data required for a search on Human Services’ HPOS Medicare verification service for healthcare providers.

The data the seller promised to provide was a Medicare card number and individual reference number (IRN) – the same data returned in an HPOS search.

The federal government has said the card data breach was likely perpetrated through “traditional criminal activity” rather than a vulnerability in Medicare systems. It has declined to provide any more detail while an AFP investigation is underway.

Just under 210,000 healthcare workers – including medical practitioners as well as administrative staff – across Australia have access to HPOS, according to Human Services’ most recent annual report. The system was accessed 3.9 million times during 2015-16.

The government today said the system not been significantly updated since it was first introduced eight years ago. It was introduced to allow people to get emergency treatment if they don’t have their card with them.

Ministers Alan Tudge and Greg Hunt said the review would examine the balance between the system’s convenience and security.

The review will be led by professor Peter Shergold, assisted by president of the Australian Medical Association Michael Gannon and president of the Royal Australian College of General Practitioners Bastian Seidel.

View the Original article