This article is more than 3 years old

This article is more than 3 years old

The human services minister, Alan Tudge, has admitted that his department was unaware that a darknet vendor had been selling Australians’ Medicare details since October 2016.

On Tuesday an investigation by the Guardian revealed that a darknet vendor on a popular auction site for illegal products claimed to have access to any Australians’ Medicare card details and could supply them on request.

At least 75 Australians’ personal details appear to have been sold on the site. The Department of Human Services has referred the matter to the Australian federal police for investigation.

Darknet sale of Medicare data 'traditional criminal activity', minister says Read more

Tudge has faced pressure over his department’s handling and response to the incident, and in an interview with ABC Breakfast’s Fran Kelly on Wednesday admitted his department had not been previously aware the data was being sold.

“We first found out about it yesterday because of the Guardian newspaper article,” he said. “Immediately upon hearing this claim, as we always do when there is a claim of criminal activity or fraud, the AFP is alerted and we undertake an internal investigation.”

He defended the department’s security procedures and said they had “very sophisticated cyber security operations in place” and regularly took advice from the Australian Signals Directorate.

The admission is likely to draw further scrutiny of the department’s security practices. An approach by some government agencies and private organisations that handle sensitive information is to constantly monitor popular darkweb sites to ensure their information has not been compromised.

The minister also said that some Australians who have had their Medicare details sold by a darknet vendor have been contacted by his department.

“The people that we know have had a Medicare card number breach have been contacted, and that is standard practice,” he said.

He declined to say how many Australians had been contacted, saying only that it was a “small number”.

The Guardian Australia staff member who requested their Medicare card details to test the veracity of the darkweb seller’s claims was contacted by the department’s fraud division on Tuesday to have their card cancelled.

The minister’s comments indicate the department may have been able to trace the credentials used by the darkweb vendor to access the Medicare details. Tudge has also stressed the advice he received from his department is that this was not the result of a hack, but rather “traditional criminal activity”.

“The advice that I’ve received from my chief information officer ... is that this isn’t a cybersecurity attack as such, but is more a traditional criminal activity ... This means that someone hasn’t hacked into a database,” he said.

“We’ve had such traditional criminal activity in the past for example, where someone has literally broken into a doctor’s clinic to seize Medicare card numbers, which they would then try and use for fraudulent purposes.”

Tudge reiterated his previous comments that no Australians’ personal health records could be accessed directly through the breach, but acknowledged that identity theft and Medicare fraud was a substantial concern.

The president of the Australian Medical Association, Michael Gannon, said he was seriously concerned about the security breach.

“This is a deeply concerning development. It is so important that this information has integrity,” he told ABC Radio AM.

Gannon raised concerns about the implementation of the government’s My Health Record system, which would allow patient details to be stored online.

The Medicare machine: patient details of 'any Australian' for sale on darknet Read more

“The electronic health record has the potential to reduce adverse drug reactions, to reduce unnecessary duplication of investigations,” he said. “But to do all that both doctors and patients needs absolute confidence in the integrity of personal information.”

Privacy advocacy groups have raised similar concerns about the scheme. The Electronic Frontiers Australia executive officer, Jon Lawrence, said: “This breach is particularly concerning as the government is working to implement a system of mandatory electronic health records.

“If core identity-related information such as Medicare numbers can’t be effectively protected, the government should be seriously reconsidering its decision to mandate the creation of electronic health records for the entire population.”

Catherine King, the shadow minister for health, and Linda Burney, the shadow minister for human services, said the breach was “incomprehensible”.

The Australian federal police said it was considering the referral from the Department of Human Services.