A cybercriminal individual or group demanding a ransom has threatened to release Medibank client data. Rhiana Whitson reporting