Scathing report on Medibank cyberattack highlights unenforced MFA

In October 2022 Medibank was breached after an IT contractor's saved credentials were stolen via information-stealing malware, enabling attackers to access the corporate VPN (which lacked mandatory MFA), move laterally, and exfiltrate 520 GB of customer and health-claims data affecting approximately 9.7 million people; the stolen data was later leaked by a ransomware gang linked to a Russian national and an offshoot of REvil. The OAIC found multiple operational failures, including credential management weaknesses and missed EDR alerts, which prolonged the intrusion.