Medibank on Thursday confirmed it had received a sample of data on 100 customers from the hackers, which it said was authentic, and warned that it expects the number of affected customers to grow substantially in coming days.

How does this compare to the Optus hack?

Loading

It is not clear yet because we don’t know enough about the nature of the respective hacks, but the data that appears to have been stolen here is much more sensitive. It could include data that would let a criminal tell that someone had received treatment for a substance addiction, for example. Home Affairs Minister Clare O’Neil has branded threats to make that information public a “dog act”.

The maximum size of this hack also appears to be smaller than the Optus hack, because Medibank counts about 4 million customers while Optus has about 10 million. However, past customer numbers are an unknown element.

What is Medibank doing about it?

Medibank chief executive David Koczkar has offered his unreserved apologies for “this crime which has been perpetrated against our customers, our people, and the broader community.” The company has sent several emails to customers and will provide further information to those in the sample data sent by the hackers.

It has set up dedicated hotlines to respond.

Australia’s cybersecurity agency, the Australian Signals Directorate, is assisting Medibank, as are private cybersecurity companies including CyberCX. The Australian Cyber Security Centre, a government agency that works with the nation’s top online spies, is also assisting. The Australian Federal Police have launched a criminal investigation. Government staff are embedding with Medibank to assist with the response.

Should Medibank customers change their Medicare numbers?

Medibank said the data from the 100 people sent by the hackers includes Medicare numbers. It is working with Services Australia to provide advice on how to protect their Medicare numbers. The hackers have also claimed they have stolen credit card information, but that has not been verified.

Loading

What should customers do?

Be wary. Keep an eye out for offers, customer support calls or even scam warnings that ask for approvals or passwords. Even if these use your real name or phone number and appear to come from a company that isn’t Medibank, they could be exploiting data from the hack. Verify any communications by independently contacting the company that appears to have sent them. Never click on suspicious links. Do not give out passwords.

Ahm can be contacted on 13 42 46 and Medibank’s number for hack inquiries is 13 23 31. Cybercrime can be reported to the government here.

I haven’t been contacted by Medibank, but I am a customer, does that mean I haven’t been affected?

No. Medibank is currently contacting the 100 people whose information was sent to it by the hackers. Medibank said it expects the list of affected customers to grow and will contact these people at that time.

I’m not a Medibank customer now but I was in the past, am I safe?

Medibank has not determined yet whether past customers are also affected by the hack, but it is possible, and some former customers have received emails from Medibank alerting them to the breach.

Has the stolen information been published anywhere?

Not that we know of. The hackers have threatened to contact customers directly, but this does not seem to have happened yet. It is common in situations like this for companies to receive a ransom demand before information is published.

Where is the hacker from?

There has been no information to indicate where the hackers are based, whether they are one person or many or whether they are state-linked.

Get news and reviews on technology, gadgets and gaming in our Technology newsletter every Friday. Sign up here.