Cybersecurity experts say the highly sensitive data of 12.9 million Australians, stolen from eScripts provider MediSecure, has already been sold on the dark web and is up for sale again.

The 6.5 terabyte trove contains identifying details such as names, phone numbers, addresses, and Medicare numbers, as well as sensitive medical information such as which drugs people had been prescribed and why.

MediSecure confirmed in May it was the victim of a ransomware attack in 2023, and last week revealed the scale of the breach, which puts it among the largest in Australian history.

It was previously unclear if the data had been sold, but cyber threat intelligence analysts say there’s a strong indication that at least one sale has taken place.

As previously reported by the ABC, the data of almost one in two Australians was initially listed for sale with a price tag of $50,000.

The ABC can reveal the post now lists the data as sold, and a subsequent post on a separate dark web forum offers to resell the entire trove at half price — for $25,000.

Neither ad specifies a currency, but the default on such marketplaces is usually US dollars.

Both appear to have been listed by the same user, who goes by the moniker “Ansgar”.

“Basically what they’re saying is, ‘We have sold this to one person, so we’re going to lower the price from the original $50,000 to $25,000’,” Jamie O’Reilly, founder of Australian company, Dvuln, which provides cybercrime intelligence services to large businesses, said.

At the original price, a buyer would be paying roughly $4 for the data of 1,000 Australians, and only $2 at the reduced rate.

“The types of people that would want this information are people who are going to be leveraging it further to exploit people,” Mr O’Reilly said.

He said at that price, it would offer a lucrative return on investment.

“The thought process a cybercriminal’s going to go through … is ‘how much is it going to cost per record?’ And then ‘how much money can I make per record or per person?'”

“Even one of those 1,000 Australians has [the] potential to pay for the rest of the 1,000.”

Dealing in doubt on the dark web

The secretive nature of dark web marketplaces means verifying whether the data has been sold is a near-impossible task.

Sales such as this one take place between anonymous parties under the cloak of encryption, and cyber security operatives need to infiltrate specific forums to monitor trades.

“We’ve got to build relationships with these people online — who are not just stealing the information, but also trading it — all while not being detected,” Mr O’Reilly said.