Overseas Student Health Cover is compulsory for international students in Australia and Medibank is the preferred provider among several institutions, including The University of Newcastle, Victoria University and RMIT. 

Some personal information has been leaked by hackers online, with the latest batch of medical information shared on November 20 after Medibank refused to pay a $10 million ransom demand. 

Medibank said it was directly contacting customers whose data has been compromised and the company has announced a range of support measures, including a financial hardship package, free identity monitoring services and reimbursements for the cost of reissuing identity documents. 

The Australian government said it recognised that the leak was “very stressful” for affected students and that it is “working closely with Medibank Private to understand the implications of the cyber incident”.

The education ministry has advised students to alert the police if they are contacted by blackmailers threatening to release personal data. 

“the health insurer is providing a range of support measures to assist international students”

Troy Williams, chief executive of Independent Tertiary Education Council Australia, called the data breach “a major concern” and said ITECA was monitoring the impact on international students. 

“ITECA is pleased to see that the health insurer is providing a range of support measures to assist international students who have had their data compromised as a result of the breach,” Williams told The PIE, adding that the issue of cyber security is of “critical importance” to the sector. 

Williams also said that current rules around mandatory OSHC are “appropriate and consistent with visa conditions for others temporarily in Australia”. 

Medibank CEO David Koczkar said, “I unreservedly apologise to our customers who have been the victims of this serious crime. As we continue to uncover the breadth and gravity of this crime, we recognise that these developments will be distressing for our customers, our people and the community – as it is to me.”

The blog the data was being posted on has now reportedly disappeared.