The ABC has been told stolen data from up to five million customers is already posted on the dark web and the health insurer is expecting worse to come.