Australia names, sanctions Russian over Medibank attack

The federal government has named and sanctioned Russian citizen Aleksandr Ermakov over his alleged involvement in the Medibank cyber attack.

The government’s action includes a “targeted financial sanction” and a travel ban on Ermakov. 

“This sanction makes it a criminal offence, punishable by up to 10 years' imprisonment and heavy fines, to provide assets to Aleksandr Ermakov, or to use or deal with his assets, including through cryptocurrency wallets or ransomware payments”, the government said.

The sanctions are imposed under the Autonomous Sanctions Amendment (Magnitsky-style and Other Thematic Sanctions) Act 2021.

It’s the first time the sanctions powers, passed in December 2021, have been used against a cyber threat actor.

In 2022, the Australian Federal Police first disclosed it believed the attack emanated from Russia, prompting Liberal senator James Paterson to call for “Magnitsky-style sanctions” against individuals.

“While Australia has yet to use Magnitsky sanctions against perpetrators of serious cyber attacks, this would be a prime candidate,” senator Paterson said at the time.

The 2022 attack against Medibank resulted in the theft of 9.7 million records, and cost the insurer $46.4 million in the 2022-2023 financial year alone.

Foreign minister Penny Wong, deputy prime minister Richard Marles, and minister for cyber security Clare O’Neil said the AFP and the Australian Signals Directorate continue to “pursue other leads”, working with other departments and international partners.

The only previous use of the sanctions powers came in March 2022, when then foreign minister Marise Payne applied the sanctions to 39 Russian individuals accused of involvement in the death of Sergei Magnitsky, whose name is carried in the legislation.