Landmark Australian cyber disaster. Russian-based threat actors (REvil/BlogXX) exfiltrated 520GB of highly sensitive medical insurance claims databases. 9.7M customers affected. Following non-payment of ransom, data including terminations and addiction treatments was leaked. Threat actor Aleksandr Ermakov was formally sanctioned globally; OAIC issued a $21.5M fine.