Answers to your important questions

Through continuing investigation and analysis, we believe the data the criminal has accessed and stolen has been released on the dark web.
If your data was accessed or stolen, you should have received a letter from us detailing what types of data were impacted and what support and advice we are providing.

 

Remain vigilant with any communications you receive (email, text, phone calls).
If a person contacts you threatening to release your data unless payment is made, please report this immediately to ReportCyber via their website or on 1300 292 371.

If you receive any suspicious emails or texts that may be scams, you can report them to ScamWatch.  ScamWatch provides information about what scams may look like and types of scams.

If your data was accessed or stolen, you should have received a letter from us detailing what types of data were impacted and what support and advice we are providing.

If your data was accessed or stolen, you should have received a letter from us detailing what types of data were impacted and what support and advice we are providing.

AFP Commissioner Reece Kershaw made the following statement:
“The AFP believes that those responsible for this cybercrime are in Russia and it will be holding talks with Russian law enforcement about the individuals believed to be involved."

Read more here

Customers should remain vigilant.

There are a number of resources online which you can find on Staying Safe Online.
We will continue to support all people who have been impacted by this crime through our Cyber Response Support Program, which includes mental health and wellbeing support, identity protection and financial hardship measures. 

Medibank & ahm experienced a cyber breach in October 2022. The criminal released files on a dark web forum in December 2022, containing customer data believed to have been stolen from our systems. We recognise the distress this may have caused you and we apologise.

The Australian Federal Police put in place a program to help protect Medibank and ahm customers whose personal information has been unlawfully released online. They have been actively monitoring the clear, dark and deep web for the sale and distribution of Medibank and ahm data. Blackmail is an offence and those who misuse stolen personal information for financial gain face a penalty of up to 10 years’ imprisonment. Law enforcement committed to swift action against anyone attempting to benefit, exploit or commit criminal offences using stolen Medibank and ahm data.

If a person contacts you online, by phone or by SMS threatening to release your data unless payment is made, please report this through ReportCyber online or by calling 1300 292 371.

You can change your address, email, password, phone number and payment details quickly and easily using the ahm app or online at members.ahm.com.au.

If you received a scam email or SMS, do not click on any links. To report a scam, please visit Scamwatch.

There are a number of resources online which you can find on Staying Safe Online.

Remember, ahm will never contact you to demand money, ask for your password or sensitive information, or attempt to call you outside of business hours unless by prior arrangement.

At ahm we use a number of different platforms and email addresses to send through our communications.

Please give close consideration to the sender of any communications you receive. 

We will never contact you to demand money, ask for your password or sensitive information, or attempt to call you outside of business hours unless by prior arrangement. If you receive any suspicious emails or texts, you can report them at Scamwatch.
We have also developed helpful resources and advice on protecting your information and being vigilant to scams.

We believe that membership numbers have been accessed or stolen by the criminal. Rest assured that if you are impacted by this, it will not affect your ability to use your cover. We are not currently recommending that you need a new membership number.

There are some proactive steps you can take to protect yourself. It is important to remain vigilant with your online security. We encourage customers to review the advice of:

• The Federal Government factsheet which has been developed for affected Medibank and ahm customers.
• The Australian Cyber Security Centre (ACSC).

We have also developed helpful resources and advice on protecting your information and being vigilant to scams.

Normal business operations have been maintained for ahm customers during the event with customers continuing to access health services. No further suspicious activity inside our systems has been detected since 12 October 2022.

Medibank and ahm has prioritised preventing unauthorised entry to its IT network and is continuing to monitor for any further suspicious activity. This has included bolstering existing monitoring, adding further detection and forensics capability across ahm’s systems and network and scaling up analytical support via specialist third parties.

We have a dedicated Cyber Response Support Program for our customers that includes:

• A cybercrime health & wellbeing line (1800 644 325) – counsellors that have experience supporting vulnerable people (such as those at risk of domestic violence) and have been trained to support victims of crime and issues related to sensitive health information. 
• Hardship support for customers who are in a uniquely vulnerable position as a result of this crime which can be accessed via our contact centre team on 13 42 46 for ahm customers.  
• Reimbursement of ID replacement fees for customers who need to replace any identity documents that have been compromised as a result of this crime.

Reach out for support.
If you’re feeling distressed or anxious, please reach out. Along with calling the cybercrime health & wellbeing line, you can contact your GP or the following support services:

• Beyond Blue (1300 224 636 / beyondblue.org.au)
• Lifeline (13 11 14 / lifeline.org.au)

If there is an imminent threat to your safety call Triple Zero.

There has not been any impact for Medibank and ahm customers accessing health services. Normal business operations have been maintained during this cyber incident.

ahm is required by law to retain certain customer (including former customer) information for particular periods of time, generally for 7 years from when a customer leaves us, but in some instances longer. 

Our former and current customers can access our dedicated Cyber Response Support Program, which includes:

• A cybercrime health & wellbeing line (1800 644 325) – counsellors that have experience supporting vulnerable people (such as those at risk of domestic violence) and have been trained to support victims of crime and issues related to sensitive health information. 
• Hardship support for customers who are in a uniquely vulnerable position as a result of this crime which can be accessed via our contact centre team on 13 42 46 for ahm customers.  
• Free identity monitoring services for customers whose identity has been compromised as a result of this crime. 
• Reimbursement of ID replacement fees for customers who need to replace any identity documents that have been compromised as a result of this crime.

Reach out for support.

If you’re feeling distressed or anxious, please reach out. Along with calling the cybercrime health & wellbeing line, you can contact your GP or the following support services:

• Beyond Blue (1300 224 636 / beyondblue.org.au)
• Lifeline (13 11 14 / lifeline.org.au)

If there is an imminent threat to your safety call Triple Zero.