The Federal Government has used its cyber sanctions for the first time on a Russian individual for his role in the Medibank data breach that occurred in 2022.
The Australian Signals Directorate and the Australian Federal Police (AFP) worked together under Operation Aquila, with other Commonwealth agencies and international partners. They linked Russian citizen and cybercriminal Aleksandr Ermakov to the breach of the Medibank Private network.
The sanctions on the individual include a “targeted financial sanction” and a travel ban. Additionally, this sanction makes it a criminal offence, punishable by up to 10 years’ imprisonment and heavy fines, to provide assets to Aleksandr Ermakov, or to use or deal with his assets, including through cryptocurrency wallets or ransomware payments.
Australian Deputy Prime Minister Richard Marles in a statement said he continues to see governments, critical infrastructure, businesses and households in Australia targeted by malicious cyber actors.
“The Australian Signals Directorate and the Australian Federal Police have worked tirelessly over the past 18 months to unmask those responsible for the cyberattack on Medibank Private and to ensure Australians are protected from malicious cyber activity,” he said.
“We continue to work with our friends and partners around the world to ensure cyber criminals are held to account for their actions and we will relentlessly pursue activities which disrupt their capability to target Australians in the cyber space.”
Minister for Foreign Affairs Penny Wong said this was an “incredible effort” from their cyber and intelligence teams.
This sanction is the result of an 18-month-long investigation over the Medibank hacking where 9.7 million records were stolen with some of the sensitive data being names, dates of birth, Medicare numbers, and sensitive medical information.
Unfortunately, some of this data was published on the dark web. We did a huge breakdown of the incident here. Medibank is still facing a class action lawsuit led by Slater and Gordon.