Medibank told investors that a “sample” of data from some 9.7 million clients had been posted on a “dark web forum” — and that more leaks were likely.

Sensitive records were posted anonymously in the early hours of Wednesday and included names, birth dates, passport numbers and information on medical claims for hundreds of customers.

The victims were separated into a “naughty” list and a “nice” list.

Some on the “naughty” list had numeric codes that appeared to link them to drug addiction, alcohol abuse and HIV.