The human services minister, Alan Tudge, has sought to downplay the sale of any Australians’ Medicare details by a darknet vendor after facing heavy pressure from the opposition and privacy groups.

On Tuesday the Guardian revealed that a darknet trader is illegally selling the Medicare details of any Australian on request by “exploiting a vulnerability” in a government system, raising concerns that the health agency may be seriously compromised.

The Guardian verified the data was genuine by requesting a Guardian staff member’s Medicare card details from the seller.

A darknet auction site transaction for details of a Guardian Australia staff member’s Medicare card

Tudge initially said he referred the matter to the Australian federal police for investigation but has faced mounting pressure from the Labor opposition over the seriousness of the breach.

In a later press conference on Tuesday, Tudge said: “The advice I have received from the chief information officer in my department is that there has not been a cyber security breach of our systems as such but rather it is more likely to have been a traditional criminal activity”.

He declined to answer questions about the details of the breach but confirmed that he and his department only became aware of the sale of Medicare data – which has been available since October 2016 and has sold 75 Australians’ personal data – when contacted by the Guardian on Monday.

The Guardian has chosen not to disclose the details of the auction site or seller.



Catherine King, the shadow minister for health, and Linda Burney, the shadow minister for human services, said the breach was “incomprehensible”.

“The revelation that Australians’ Medicare identities are available for purchase on the darkweb is incomprehensible. But equally disturbing is the Turnbull government’s incompetent response,” they said in a joint statement.

“The government’s attempt to dodge questions on this simply isn’t good enough – the lack of information on this serious security breach is pathetic and Australians deserve better.”

The investigation is likely to draw further attention to Australia’s cyber security defences. Several government agencies have faced criticism from the Australian National Audit Office over their handling of sensitive information. Experts have frequently warned that Australia has a skills shortage in technical cybersecurity that could be placing data at risk.

The Labor MP Tim Watts said the case raised concerns about the department’s monitoring of darknet sites.



“A ‘no comment’ from DHS isn’t good enough at this point either. Prima facie evidence of an exploit exposing this data demands explanation,” he said on Twitter.

Banks et al often pay private infosec firms to monitor markets like this for their data. Does .gov.au do similar assurance for its datasets? https://t.co/yToExCkvEy — Tim Watts MP (@TimWattsMP) July 3, 2017

Government agencies commonly monitor websites where criminal groups sell personal information to determine whether their data has been compromised.

The minister said the information for sale “was not sufficient to access any personal health record”.

But the primary concern about the disclosure of Medicare card details is their value to organised crime groups because they allow them to produce fake physical Medicare cards with legitimate information that can then be used for identification fraud. These cards have been used by drug syndicates to buy goods and lease or buy property or cars.

The assistant treasurer, Michael Sukkar, told Sky News the breach was “extremely concerning”.

“It’s very alarming to me if any of that data is finding its way into hands that it shouldn’t be,” he said. “This is going to be an ongoing issue as more and more of our information ultimately is collected and stored online. Governments are going to have to be much better at protecting that data.”

The Labor frontbencher Brendan O’Connor told Sky News the government had a lot of explaining to do.

“People are rendering up, yielding their personal information to government agencies and they don’t expect them to invaded or accessed so easily as this would suggest,” he said.

“There is a lot of explaining to do, and there needs to be some accountability now by the minister and some explanation as to the extent and nature of the breach and what the government will do about it.”

The executive officer of Electronic Frontiers Australia, Jon Lawrence, said regular data breaches had undermined the public’s trust in government agencies.

“This breach is particularly concerning as the government is working to implement a system of mandatory electronic health records,” Lawrence said. “If core identity-related information such as Medicare numbers can’t be effectively protected, the government should be seriously reconsidering its decision to mandate the creation of electronic health records for the entire population.

“Information security and privacy need to be fundamental, core priorities for all government agencies. There is unfortunately a great deal of evidence to suggest that this is not yet the case.”