Services Australia and federal law enforcement agencies are investigating a Dark Forums advertisement offering 25 million Medicare records for sale, as customer reports of phishing texts promising fake rebates climb during Cyber Security Action Month.
The Australian Financial Review reported that a sample set of 38 files appeared on the forum on 28 September, listing names, purported card numbers, expiry dates, dates of birth, emails, mobile numbers and home addresses. Officials have not confirmed the dataset’s authenticity but said they are treating the post as a serious incident with potential identity-theft implications.
Parallel scam wave
Separately, Services Australia continues to publish alerts about electronic funds transfer scams that mimic Medicare or myGov branding. Victims receive emails claiming a benefit is owed and are directed to fake portals that harvest banking credentials. Official guidance stresses the agency never asks customers to click links in SMS or email to update Medicare details or to scan QR codes to log in.
Reported scams can be forwarded to reportascam@servicesaustralia.gov.au. The agency works with the Australian Cyber Security Centre to take down phishing domains, but criminals rotate URLs quickly, especially after long weekends when call-centre staffing is thinner.
What affected people should do
Services Australia advises customers who fear their card details are compromised to monitor myGov activity, update passwords from a clean device, and contact Services Australia if unfamiliar claims appear. Card replacement is not always required when only a number was exposed without other authentication factors, but case managers may issue new identifiers when fraud is detected.
The incident has renewed calls for mandatory breach reporting timelines for contractors that touch health identifiers. Cyber Security Minister spokespeople said intelligence agencies are assisting with attribution but declined to comment on whether the sample matched internal formats.
Analysts note that Medicare numbers alone are not sufficient to access clinical records, yet they remain valuable for invoicing fraud and for social-engineering calls that reference accurate personal data. Until investigators publish findings, the practical defence for households is scepticism toward any unsolicited payment message, regardless of how official the logo looks.