Key points

• The Office of the Australian Information Commissioner (OAIC) has commenced civil penalty proceedings against Medibank arising from its October 2022 data breach. The OAIC has now published its concise statement filed as part of those proceedings, which sheds some valuable light on the OAIC’s expectations for organisations’ cybersecurity practices.
• The OAIC’s concise statement includes a lengthy list of cybersecurity measures it considers would constitute reasonable steps that should be taken to protect personal information by an organisation of Medibank’s size and resources. These measures include implementing multi-factor authentication and a range of different access controls and other security controls, together with monitoring and testing of these security controls.
• Organisations should compare their own cybersecurity measures against the list included in the OAIC’s concise statement and consider implementing any uplifts that may be required to meet the OAIC’s expectations.

Background

We have previously published a client alert summarising the background and history to these proceedings in more detail.

Briefly, the OAIC commenced civil penalty proceedings against Medibank following a data breach that occurred in October 2022. The OAIC alleges that Medibank failed to comply with its obligations under Australian Privacy Principle (APP) 11.1, as found in Schedule 1 to the Privacy Act 1988 (Cth). Under APP 11.1, Medibank is required to take such steps as are reasonable in the circumstances to protect the personal information it holds from misuse, interference and loss, as well as from unauthorised access, modification or disclosure.

What has happened now?

On 17 June 2024, the OAIC updated its 5 June 2024 media release to include a link to a copy of the concise statement filed on behalf of the Australian Information Commissioner in the proceedings against Medibank. A ‘concise statement’ is a court document that may be filed as part of the process of commencing legal proceedings, the aim of which is to concisely and directly set out:

• the important facts giving rise to the claim;
• the relief sought from the court (and against whom);
• the primary legal grounds (causes of action) for the relief sought; and
• the alleged harm suffered by the applicant, including (wherever possible) a conservative and realistic estimate or range of loss and damage.

What does the concise statement say?

While the factual matters set out in the concise statement have yet to be the subject of any evidence given in court, the concise statement reveals some additional details as to how the Medibank data breach is alleged to have occurred.

The OAIC’s concise statement claims that:

• the data breach arose as a result of a third party contractor saving his Medibank username and password for a number of Medibank accounts to his personal internet browser profile on the work computer he used to provide IT services to Medibank and then syncing that internet browser profile to his personal computer;
• these credentials were then subsequently stolen from the contractor’s personal computer when it became infected with a form of malware (the details of which are redacted from the published version of the concise statement);
• the threat actor was then able to use these stolen credentials to log on to Medibank’s corporate network via a Virtual Private Network (VPN);
• importantly, the concise statement alleges that this remote access was able to occur due to Medibank’s corporate network not requiring multi-factor authentication (MFA) to log on via the VPN and that several automated alerts relating to this unauthorised access were not appropriately triaged or escalated by Medibank or its service provider; and
• this resulted in the threat actor being able to access Medibank's corporate network for a period of approximately six weeks before being detected, with the result that a large volume of data was able to be exfiltrated by the threat actor.

Relevantly for other organisations, the concise statement also sets out in Annexure B a detailed description of a range of cybersecurity measures that the OAIC alleges Medibank should have implemented (either in their entirety or in some lesser combination) in order to comply with its obligation under APP 11.1 to protect the personal information that Medibank held.

What cybersecurity measures did the OAIC identify as constituting reasonable steps?

As a starting point, it is important to note that the OAIC recognises that what constitutes reasonable steps to protect personal information will depend on the size of the organisation in question, its resources and the nature and volume of the personal information it held (including whether any sensitive information is held). This is consistent with the OAIC’s guidance on interpreting APP 11 and the OAIC’s separate guide to securing personal information (which is currently under review).

The OAIC’s concise statement specifies that at the relevant time:

• for the financial year ending 30 June 2023 (the financial year in which the data breach occurred), Medibank’s revenue was approximately AU$7.1 billion, with an annual profit before tax of AU$727.1 million;
• Medibank’s core IT security function comprised a team of 13 full-time IT security professionals; and
• Medibank’s FY22 information technology budget was approximately AU$4 million to AU$5 million, of which AU$1 million was allocated for cyber security (although this figure seems low given the number of specialist IT security professionals).

These statistics suggest that Medibank’s resources were on the higher end of the spectrum, with the result that a correspondingly higher level of obligation would, in the OAIC's view, be necessary to satisfy Medibank’s obligations under APP 11.1. Annexure B of the OAIC's concise statement alleges that all of (or a sufficient combination of) the following measures would be required:

1. implementing MFA for authenticating remote access users of a VPN;
2. implementing MFA for authenticating users to sensitive or critical information assets once inside an organisation’s network perimeter;
3. implementing proper change management controls for changes made to information security controls (including changes to the configuration of existing controls);
4. implementing privileged access management controls (including role-based access controls and a least-privileges-necessary approach) that are regularly reviewed to check that privileged access is not granted unnecessarily and that access for dormant accounts is identified and revoked;
5. implementing appropriate monitoring for privileged accounts, including to identify normal behaviour, to configure alerts for unusual or suspicious behaviour and ensure that such alerts are monitored and responded to;
6. implementing appropriate password complexity requirements for user accounts, including by implementing appropriate controls to prevent the use of insecure or common passwords and the re-use of passwords across multiple accounts;
7. implementing password monitoring and review processes to ensure that passwords used to access important data repositories and servers are encrypted and not stored in plain text, including by undertaking regular password usage audits and checking for tools that store passwords in plain text;
8. implementing appropriate security monitoring processes and procedures to detect and respond to information security incidents in a timely manner, including by:

a. undertaking a first-level review and triage of all security alerts generated by the organisation’s endpoint detection and response security software (which implicitly suggests that the OAIC’s view is that organisations must have implemented such software in the first place);

b. having procedures in place to escalate security alerts that are not benign or false positives;

c. regularly reviewing the first-level review outputs to ensure that alerts were properly reviewed, triaged, assessed and escalated (where required); and

d. ensuring that mechanisms are in place to generate a security alert where large volumes of data are copied or extracted from storage repositories;

9. implementing appropriate security assurance testing for sensitive or critical information assets and key information security controls, including annual penetration testing of VPNs (including to verify that MFA is properly configured), annual audits and testing of information controls (including in relation to MFA) to verify that such controls are effective and conducting further testing if any configuration changes are made to those controls;
10. implementing appropriate application controls for critical servers, including servers used to access sensitive or critical information assets; and
11. implementing effective contractor assurance, including to conduct regular audits, inspections and testing to ensure that third-party contractors with access to the organisation’s IT network and IT systems are complying with the organisation’s information security policies.

In addition, Annexure B of the concise statement asserts that the reasonableness of these measures was informed by the following cybersecurity and information security standards and frameworks:

• the ‘essential eight’ key controls identified by the Australian Cyber Security Centre;
• Prudential Standard CPS 234 and the related Prudential Practice Guide CPG 234 as published by the Australian Prudential Regulation Authority (APRA), which applied to Medibank as an APRA-regulated entity;
• the Information Security Manual published by the Australian Signals Directorate;
• the United States National Institute of Standards and Technology (NIST) Cybersecurity Framework (which had been adopted by Medibank as a benchmark); and
• the ISO 27000 series of information security standards published by The International Organisation for Standardisation and International Electrotechnical Commission.

While these claims have not yet been tested in court, Annexure C of the OAIC’s concise statement alleges that a range of internal and external reports from as early as 2018 identified deficiencies in Medibank’s cybersecurity and information security framework.

What does this mean for your organisation?

While some of the allegations in the concise statement are specific to Medibank’s circumstances, Annexure B in particular provides a helpful checklist for organisations by setting out the specific measures that the OAIC expects well-resourced organisations to have implemented.

We therefore recommend that your organisation should:

1. review the type, amount and sensitivity of the personal information (including sensitive information) the organisation holds;
2. compare the size, scale and resources of your organisation to that of Medibank;
3. conduct a gap analysis of your organisation’s cybersecurity measures against the above list included in the OAIC’s concise statement, including by referring to the cybersecurity and information security standards and frameworks mentioned in the concise statement; and
4. to the extent that any gaps are revealed, consider whether it would be a reasonable step for your organisation to implement the necessary uplifts to address that gap (bearing in mind the comparison between the size, scale and resources of your organisation relative to those of Medibank and the nature, volume and sensitivity of the personal information that your organisation holds relative to the information held by Medibank).