<
https://www.abc.net.au/news/2024-06-17/biz-medibank-court-absence-of-multi-factor-authentication/103987732>
'The private Australian health insurer Medibank did not have multi factor
authentication protections on its private network when it was successfully
hacked, new court filings allege.
The Office of the Australian Information Commissioner (OAIC) alleges a lack of
multi factor authentication at Medibank led to the 2022 data hack of nearly 9.7
million current and previous customers.
Documents filed to the Federal Court on Monday by the OAIC allege the massive
data breach stemmed from an employee of a Medibank contractor, an IT service
desk operator, who saved his login details to a personal web browser installed
on his work computer.
When he then signed into his internet browser on his personal computer, the
credentials were synced to that device.
Those details were then stolen from his personal computer on or around August
7, 2022, with malware, and the thief was then able to access Medibank's
Microsoft Exchange Server and virtual private network (VPN).
"Global Protect VPN did not require two or more proofs of identity or
multi-factor authentication (MFA)," the court documents said.
"Rather, Medibank's Global Protect VPN was configured so that only a device
certificate, or a username and password (such as the Medibank Credentials), was
required."
The hack led to the personal details, including names, addresses, Medicare
numbers health information and financial information of past and present
Medibank and ahm customers being published on the dark web.
The OAIC is alleging Medibank breached sections of the Privacy Act by not
taking enough steps to protect the sensitive information it held about its
customers.
In 2018 and 2020, Medibank was made aware of weaknesses and vulnerabilities in
its cyber security, including "deficiencies regarding insecure or weak password
requirements".
A separate report by Datacom in 2020 found a "number of individuals had been
given excessive privileges to perform simple daily routines, and that MFA had
not been enabled for privileged and non-privileged users which was described as
a 'critical' defect".'
Via Violet Blue’s
Cybersecurity Roundup: June 18, 2024
https://www.patreon.com/posts/cybersecurity-18-106415772
Cheers,
*** Xanni ***
--
mailto:xanni@xanadu.net Andrew Pam
http://xanadu.com.au/ Chief Scientist, Xanadu
https://glasswings.com.au/ Partner, Glass Wings
https://sericyb.com.au/ Manager, Serious Cybernetics
