Prescription provider named in major health data breach

"We have taken immediate steps to mitigate any potential impact on our systems. While we continue to gather more information, early indicators suggest the incident originated from one of our third-party vendors," the provider said on May 16.

"MediSecure is actively assisting the Australian Digital Health Agency and the National Cyber Security Coordinator to manage the impacts of the incident," the statement said.

"MediSecure understands the importance of transparency and will provide further updates via our website as soon as more information becomes available."

Those who believe they could be affected by the breach do not need to take any action at this stage and will be notified by MediSecure if their information has been released.

MediSecure is an Australian owned eHealth company managing electronic prescriptions for healthcare providers.

The technology allows pharmacists to access a patient's prescription online via MediSecure.

The company said its technology helps "reduce errors in the prescribing and dispensing of medicines".

MediSecure, which launched in 2009, stopped being used for new scripts in November 2023 as the government transitioned to the publicly funded national prescription delivery service eRx, RMIT Centre for Cyber Security Research and Innovation director Professor Matthew Warren said.

"However, it was kept online to preserve existing scripts issued through its service," he said.

"It looks as if the patients that will be impacted will be old, existing customers which may minimise any impact."

The National Cyber Security Coordinator Michelle McGuinness said she was "working with agencies across the Australian Government, states and territories to coordinate a whole-of-government response to this incident".

The Australian Signals Directorate Cyber Security Centre was aware of the alleged attack and the Australian Federal Police has launched an investigation, she said.

"We are in the very preliminary stages of our response and there is limited detail to share at this stage, but I will continue to provide updates as we progress while working closely with the affected commercial organisation to address the impacts caused by the incident."

The federal minister for cyber security Clare O'Neil said the government convened a National Coordination Mechanism regarding the hack on May 16 and would make more information available to the public "in due course".

AustCyber CEO Chris Kirk said the data breach was a "cautionary tale for our nation".

"Australia's cyber security posture is under immense pressure with the volume, frequency and ferocity of attacks steadily increasing year on year," he said.

"One attack now occurs every six minutes at an average cost of $71,600 to large Australian businesses.

"It's clear we need to fortify the competitiveness of Australia's cyber security dramatically to keep pace with the standards of our international counterparts and potential threat actors.

Mr Kirk said this "will only occur by building our own sovereign cyber security capabilities at pace".

"We need an extra 85,000 dedicated cyber security professionals by 2030, a 66 per cent increase on the current workforce," he said.

"If we fail to plug this skills gap through strong education pathways and support for local technologies, the long-term impact on Australian citizens and businesses will be heavy and non-discriminatory."

The investigation is in its early stages and while there's no need to panic, the public should stay vigilant to scams, Edith Cowan University associate professor Paul Haskell-Dowland said.

"With another scam being announced, the Australian public will rightly be concerned over the implications for potential personal information disclosure as a consequence of the MediSecure ransomware incident," he said.

"It is unclear if data has been exfiltrated (stolen) from MediSecure, but users of their service should be cautious of any communications purporting to be from the organisation."

The associate professor said Australians were likely to see scammers, who were not involved in the breach, using the MediSecure story as a "hook" to target victims.

"Never click on links in unsolicited emails or SMS messages and independently validate the legitimacy of calls," he said.