MediSecure ransomware attack

In May 2024, MediSecure — one of Australia's two national electronic prescription providers — disclosed a ransomware attack that exposed the personal and health information of roughly 12.9 million Australians, making it one of the largest data breaches in Australian history and ultimately destroying the company.

What happened

MediSecure operated the digital infrastructure that allowed doctors to issue, and pharmacies to dispense, electronic prescriptions across Australia. The attack was later determined to have begun around 13 April 2024, with the company publicly confirming a "large-scale ransomware data breach" on 16 May 2024. The breach was traced to a third-party vendor in MediSecure's supply chain.

The stolen data was extensive. It included individuals' names, dates of birth, postal and email addresses, phone numbers, Individual Healthcare Identifiers (IHI), and Medicare card numbers, along with deeply sensitive clinical fields: prescription medication details, the medical reason for each prescription, and dosage instructions. The archive also contained Pensioner Concession, Commonwealth Seniors, Healthcare Concession, and Department of Veterans' Affairs card numbers.

Impact

• Approximately 12.9 million Australians had data exposed — close to half the national population.
• A threat actor advertised the stolen database for sale on a cybercrime forum for around US$50,000, and analysts assessed the data was likely sold.
• The exposure of prescription and diagnosis data created uniquely sensitive privacy harms, revealing individuals' medical conditions.

Collapse of the company

Unable to absorb the costs of the incident and denied a government bailout, MediSecure entered voluntary administration in early June 2024, with FTI Consulting appointed as administrators. The company subsequently moved into liquidation, becoming one of the clearest cases of a business driven out of existence by a single cyberattack. Because MediSecure had already been superseded as the active national e-prescription provider, the breach did not disrupt ongoing prescription services, but it left a defunct company holding the liability for millions of records.

Why it matters

The MediSecure breach is a landmark Australian case on three fronts: the uniquely sensitive nature of prescription and diagnosis data, the supply-chain origin of the compromise, and the existential business risk of a major breach for a mid-sized health-tech firm. Arriving amid the post-Optus, post-Medibank reckoning over Australian data security, it reinforced national debates about data minimization and retention — why a legacy provider still held health records on nearly 13 million people — and accelerated reforms to Australia's privacy and critical-infrastructure regimes.