{
  "id": "case-sanctions-ermakov-medibank",
  "slug": "sanctions-ermakov-medibank-ransomware",
  "title": "International Sanctions on Aleksandr Ermakov (Medibank Breach)",
  "summary": "First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.",
  "case_number": "DFAT Autonomous Cyber Sanctions 2024",
  "court": "Department of Foreign Affairs & Trade (Australia) / OFAC",
  "district": "International Sanctions",
  "country": "Australia",
  "opened_at": "2024-01-23",
  "status": "fugitive",
  "victim_sector": "Healthcare & Private Health Insurance",
  "victim_country": "Australia",
  "loss_amount_usd": 45000000,
  "loss_amount_note": "Direct remediation expenses and regulatory compliance costs following breach of 9.7M individuals.",
  "first_seen_at": "2022-10-12T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "revil-sodinokibi",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Threat actor gained initial network access using stolen credentials belonging to a third-party IT service desk contractor lacking multi-factor authentication.",
      "evidence_locator": "Australian Cyber Security Centre Advisory (Medibank Investigation)",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Australian Signals Directorate & AFP Joint Attribution Release",
      "source_url": "https://www.cyber.gov.au",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    },
    {
      "technique_id": "T1567",
      "evidence_excerpt": "Exfiltrated 200 gigabytes of customer data over encrypted HTTPS channels to external virtual private servers before presenting $9.7M ransom demand.",
      "evidence_locator": "ASIC Enforcement Notice on Medibank Private",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "ASIC Regulatory Filing",
      "source_url": "https://asic.gov.au",
      "technique_name": "Exfiltration Over Web Service",
      "tactic": "Exfiltration"
    }
  ],
  "events": [
    {
      "event_type": "incident",
      "event_date": "2022-10-12",
      "description": "Medibank Private detects anomalous exfiltration activity across customer database servers."
    },
    {
      "event_type": "extortion",
      "event_date": "2022-11-07",
      "description": "Attacker publishes sensitive medical records of 9.7 million customers on dark web forums."
    },
    {
      "event_type": "sanctions",
      "event_date": "2024-01-23",
      "description": "Australia, US, and UK impose synchronized cyber sanctions and financial freezes against Ermakov."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Healthcare & Private Health Insurance infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. First joint cyber sanctions package deployed cooperatively by Australia, the United States, and the United Kingdom against Russian national Aleksandr Ermakov for orchestrating the catastrophic 2022 Medibank Private breach, stealing and weaponizing medical files of 9.7 million patients on dark web leak channels after extortion was refused.",
    "blast_radius": "Resulted in $45,000,000 in documented financial liabilities. Direct remediation expenses and regulatory compliance costs following breach of 9.7M individuals.",
    "kill_chain": [
      {
        "phase": "Phase 1: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Threat actor gained initial network access using stolen credentials belonging to a third-party IT service desk contractor lacking multi-factor authentication.",
        "technical_artifacts": [
          "T1078",
          "Valid Accounts"
        ],
        "mitre_technique_id": "T1078"
      },
      {
        "phase": "Phase 2: Exfiltration",
        "title": "Encrypted Cloud Data Exfiltration",
        "description": "Exfiltrated 200 gigabytes of customer data over encrypted HTTPS channels to external virtual private servers before presenting $9.7M ransom demand.",
        "technical_artifacts": [
          "T1567",
          "Exfiltration Over Web Service"
        ],
        "mitre_technique_id": "T1567"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Healthcare & Private Health Insurance infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}