The Australian federal government has revealed Russian citizen “and cybercriminal” Aleksandr Ermakov is linked to the Medibank Private data breach that saw PII and critical medical information of Australian citizens and international students leaked on the dark web.
In an Australian first, the government also imposed a targeted financial sanction and a travel ban on Aleksandr Ermakov. This means providing assets to Ermakov or to use or deal with his assets, including through cryptocurrency wallets or ransomware payments, is a criminal offence punishable by up to 10 years’ imprisonment and heavy fines.
The announcement sends a clear signal that individuals connected to cybercrimes committed in Australia will be identified and targeted with the hope that it will have some deterrent effect, emeritus professor of criminology at Flinders University Andrew Goldsmith told CSO.
Australia confirms REvil is behind the Medibank breach
In a press conference, Home Affairs and Cyber Security Minister Clare O’Neil confirmed that Ermakov is a member of REvil. In November 2022, the Australian Federal Police (AFP) had revealed that those responsible for the data breach of were in Russia. AFP Commissioner Reece Kershaw said at the time that the AFP believed to know those responsible for the breach. A few months later in an interview for 60 Minutes, Reece said the AFP had shared intelligence with Russian authorities and expected to see a result but were still waiting for any response.
Deputy Prime Minister Richard Marles said the AFP worked with overseas partners including the FBI, the NSA in America, GCHQ in the UK.
The likely results from the sanctions
At the time of the Medibank data breach, AFP’s Kershaw had said that anyone involved in the attack was a focus of the investigation and that cyber criminals operate like a business with affiliates and associates, who are supporting the business, and that some affiliates are believed to be in other countries.
