The government is urgently investigating claims that Medicare details have been breached and offered for sale on the ‘dark web’.
The government is urgently investigating claims that Medicare details have been breached and offered for sale on the ‘dark web’. Andy Baker

Australians' Medicare details for sale on dark web

HACKERS are selling the Medicare card numbers of Australians on the 'dark web', which could be used to steal private health records.

The Federal Government has confirmed it's urgently investigating the security breach and has referred the matter to the Australian Federal Police.

A journalist from The Guardian revealed he was able to purchase his own Medicare card details from a vendor on the dark web for just $30, from a device called 'the Medicare machine'.

Human Services Minister Alan Tudge said the concerning incident was being treated seriously, but that it's believed the information being sold isn't sufficient to access any personal records.

That's a claim disputed by IT experts, who have called for the government to abandon plans to automatically create a My Health Record for every Australian.

The availability of Medicare data on the dark web has heightened security concerns about the $1 billion My Health Record scheme.

News Corp Australia

IT specialist Paul Power says if you have someone's data that's is linked to their name, date of birth and Medicare number, hackers can access a person's Individual Healthcare Identifier and use this to access their My Health Record.

The My Health Record will contain information that can reveal sensitive information such as mental illness, a sexually transmitted disease or an abortion and could be used to hold them to ransom.

Mr Power has been writing to Health Minister Greg Hunt to warn him the My Health Record was vulnerable to hackers.

He said while it was unfortunate Medicare information was for sale on the dark web it might make the government take his warnings seriously.

"The fact it has been exposed is a good thing because it raises the awareness of decision makers," he said.

"Some people need to have it shoved in their faces and that has been done," he said.

Mr Tudge insisted he had received assurances today that the information obtained by The Guardian journalist wasn't sufficient to obtain other records.

"The only information claimed to be supplied by the site was the Medicare card number," he said.

"The journalist was asked to provide his own name and date of birth in order to obtain the Medicare card number," Mr Tudge said.

"Any apparent unauthorised access to Medicare card numbers is nevertheless of great concern."

He said the Department of Human Services was receiving constant advice about its cyber security arrangements from the Australian Signals Directorate.

Mr Tudge said he was not able to provide details but confirmed that authorities were regularly investigating activities on the dark web.

"The security of personal data is an extremely serious matter. Thorough investigations are conducted whenever claims such as this are made."

News Corp revealed earlier this week that IT experts were concerned about the security of the My Health Record because the centralised data base could be accessed from more than 100,000 medical practices.

More than four million Aussies already have one of these records but next year the government will automatically create a digital health record for everyone unless they opt out of the system.

"The chances of 100 per cent securing a system with 100,000 access points against being hacked is close to zero," Mr Power said. "The weakness of the whole system is only as strong as its weakest link."

Mr Power says Australia should follow Germany and decentralise the storage of personal health information by attaching it to the Medicare card rather than storing the My Health Record in a centralised data base vulnerable to hacking.

Assistant Minister to the Treasurer Michael Sukkar said the revelation was "extremely concerning".

"It's very alarming to me if any of that data is finding its way into hands that it shouldn't be," Mr Sukkar told Sky News.

"This is going to be an ongoing issue as more and more of our information ultimately is collected and stored online. Governments are going to have to be much better at protecting that data."

The dark web is used by many people for different things but it's infamously used by criminals to hide illegal activity online.

Originally published as Medicare details sold on 'dark web'