Australia publicly names and sanctions Russian hacker over Medibank data leak

Australia has publicly named and imposed cyber sanctions on a Russian hacker for his alleged role in a 2022 ransomware attack, in the country’s first use of the penalty.

Australia has publicly named and imposed cyber sanctions on a Russian hacker for his alleged role in a 2022 ransomware attack, in the country’s first use of the penalty. The attack stole sensitive personal data from 9.7 million customers of Medibank, one of Australia’s largest private health insurers: including names, dates of births, medical information and Medicare numbers. Some of these records were published on the dark web, according to Australian authorities. At the time, the Australian Federal Police said investigators knew the identity of the attackers but declined to name them. On Tuesday, the Australian government revealed the name of the individual sanctioned — Russian national Aleksandr Ermakov, 33, an alleged member of the Russian ransomware gang REvil. The sanctions make it a criminal offense to provide assets to Ermakov, or to use or deal with his assets, including through cryptocurrency wallets or ransomware payments, according to a government news release. The offense is punishable by up to 10 years’ imprisonment. The government has also imposed a travel ban on Ermakov. Australian authorities have “worked tirelessly over the past 18 months to unmask those responsible for the cyberattack on Medibank Private,” Richard Marles, deputy prime minister and defense minister, said in the release.