Medibank won’t pay the ransom. Good
Medibank refused the ransom for its stolen customer data. Paying doesn’t guarantee the data gets deleted.
Yesterday Medibank, Australia’s largest health insurer, said it won’t pay the criminals who stole data on millions of customers, including health claims. The government supported the decision.
It’s a hard call, and people’s private data may now be published. But paying for “deletion” rests on a promise from criminals who just stole from you. There’s no way to check that every copy is gone, and paid groups have come back later or sold the data anyway.
What actually limits the damage:
- Hold less sensitive data, and delete old records on schedule.
- Segment it, so one stolen login can’t reach everything.
- Watch for large data exports and alert on them.
- Prepare the customer side: how you’ll tell people, what support you’ll offer, how you’ll replace ID documents.
- Decide your ransom policy before the crisis, with legal advice and leadership, not at 3 am.
Encrypted servers can sometimes be restored from backups. Stolen data can’t be un-stolen. Prevention is the only real option for it.