The Medicare CEO and Board still have their jobs.

I guess they will scapegoat some middle manager from IT for the mega cockup.

Didn't you see? They're blaming Russia. Because as we all know when you're caught with your pants down, it's the intruder's fault.

It wasn’t Medicare. It was Medibank.

Medicare is the public (government) health scheme and Medibank is a health insurance provider.

Indeed.

My apols.

Sure, let's go after the people who robbed the bank. But don't you think that maybe you should have installed a vault rather than a fly screen door? Shouldn't someone be held accountable for that?

I saw something in an earlier press release about how they gained access to a login that allowed them to access all 9 million records. That is a fundamental failure of:

- design

- implementation

- security

- IT governance

- QA

- legislation and/or law enforcement

- shareholder governance

But more than the fact all 9 million records were available to any account, what about field level security?

This is an enormous failure by coders/programmers turning a blind eye to poorly implemented systems and just walking home with the pay check. And all management up from there all the way to the prime ministers desk. We could look at the lack of protection for whistleblowers for a start.

It is the Aussies fault that they were complacent about their own security systems. If my house is burgled then, if I have poor locks or no CCTV, it is my fault that I made it easy to break in.

The problem is Aussies still think that they live in isolation like it was before the Internet. They have to realise that the Internet does not respect geographical boundaries.

If course they could adopt the model used by Russia and China where everything is filtered....

Aussie are no different to the average Brit, American or any other first world country..

We allow governments and corporate to continue to accumulate data about us without regard for the consequences. We freely post the minutia of our lives on so called social media, once assembled it so easy, the things one would dumpster dive is now laid out conveniently at our finger tips to search and correlate.

And we howl when this gets abused, yet we do little to change the situation, we line up for our free email account, knowing full well its being mined. We accept governments excuses we need to store and link everything together in one place. We put identifiers on census data so we make sure everyone completes it, for want reason likely nothing more than some mindless compliance.

For years others have been warning of the consequences of these honey pots, and to those would would blame the programmers, network and systems engineers have a look at yourself.. Is everything you have done is perfect. I certainly cant make that claim.

There does need to be consequences for corporate's and government but these consequences need to be painful and serious. Not some dinky fine that is a cost of doing business. Start jailing directors and you will quickly find the C-Suite quickly finding the $$ to properly support the necessary workers and upgrades.

But we also need to accept some responsibility as individuals.. The excuse is its inconvenient, too hard, or too slow I have heard a myriad of excuse to lower barriers. Privacy matters, but over time we have allowed or been lulled into thinking you don't have the right to privacy (or in Aussies case we don't have "rights"). Maybe I should misquote Benjamin Franklin

"Those who would give up Privacy, to purchase a little convenience, deserve neither Privacy nor Safety."

Yes maybe their security was lax - I don't know, I'm not an expert on such things, but the above comments come over very much like "She was asking for it, wearing such a short skirt.". At least medibank did the right thing by refusing to pay. If more organisations had the sense to do that the problem wouldn't exist.

The victims are the customers, not Medibank. No-one is blaming the customers.

Since this is a state sponsored attack - paying them or not paying them probably doesn't really determine their future behaviour - the state sponsor is satisfied with creating chaos, fear, uncertainty etc.

This is simply a criminal enterprise out to obtain maximum value. They are simply making an example of Medibank's refusal to pay so they can point to the consequences when they strike their next victim.

State sponsored actors tend to be information gathers, I have worked on numerous events, some criminal some state-based and the later is almost always about gathering information and access. State based actors when they strike destroy/disrupt not hold to ransom.

These folks are simply protected as Russia wont dont anything about them, likely due to kickbacks.