The Australian Federal Police will investigate the sale of Medicare card information on the dark web following a referral from the Human Services Minister Alan Tudge.
A dark web vendor is selling Medicare card details for less than $30 online, the Guardian Australia reports.
The website in question is a popular auction site used to buy and sell illegal goods, including drugs and fraud materials.
It is part of the so-called ‘dark web’, the unlisted section of the internet that is not indexed or discoverable through search engines.
It is accessed via the Tor browser, which makes users anonymous and uses the digital crypto-currency Bitcoin to further disguise buyers and sellers from law enforcement.
According to the Guardian, a staff journalist requested their own data and received their Medicare number after providing their name and date of birth.
Mr Tudge’s office said it had received advice the information provided by the seller was not enough to access a private health record.
“Any apparent unauthorised access to Medicare card numbers is nevertheless of great concern,” the statement from Mr Tudge’s office read.
The vendor has sold at least 75 sets of Medicare card details since October 2016, according to the Guardian.
The method used to acquire the details is not yet known, but the seller reportedly claims they are “exploiting a vulnerability” in the government’s systems.
Mr Tudge said he could not comment on cyber operations, but said dark web investigations “occur regularly”.
Assistant Treasurer Michael Sukkar said the government took "extraordinarily seriously" the data it collected on individuals.
"It's very alarming to me if any of that data is finding its way into hands that it shouldn't be," he told Sky News on Tuesday.
"This is going to be an ongoing issue as more and more of our information ultimately is collected and stored online. Governments are going to have to be much better at protecting that data."
Mr Sukkar said he understood concerns people held over the "extremely concerning" reports of the breach.
"All I can do is assure you that we will do absolutely everything possible to protect that data," he said.
"If that means more work and more upgrades to our system, then so be it."
