The federal government didn't know personal Medicare details were being sold on the dark web for several months until claims were raised by a journalist.
But the minister responsible insists nobody's health records are at risk, nor has the system been subject to a cyber attack.
Human Services Minister Alan Tudge says the issue is being taken seriously and has asked the Australian Federal Police to investigate possible criminal activity.
It stems from a report in The Guardian on how one of its own reporters was able to buy his Medicare card number from a "darknet" trader for less than $30.
The vendor reportedly digs up the details based on a person's full name and date of birth.
At least 75 files are alleged to have been sold since October last year.
Mr Tudge conceded his department only became aware of the activity on Monday and immediately referred the matter to authorities.
"They will get to the bottom of all this," he told reporters in Canberra on Tuesday.
"The advice from our chief information officer is there hasn't been a cyber security attack on our systems as such and it is a traditional criminal activity."
The number of people affected is believed to be only very small, he said, indicating his department had started contacting some victims.
But he stressed no-one's health records can be obtained with a Medicare number.
"Anybody who suggests otherwise is irresponsible and is fear mongering," he said.
"There is no indication that there has been a wide-scale breach."
There are fears, however, hackers have exploited a vulnerability and could use the data for criminal purposes such as identity fraud.
Acting Opposition Leader Tanya Plibersek said it was critical the government explain how many records have been breached.
"We have seen weak statements that don't go to the key issues about how many records, how long they have been available, when the government knew and what have they done," she told reporters in Melbourne.
The minister would not say who is responsible for checking the data and why it wasn't picked up sooner.
In an earlier statement, he said investigations into activities on the dark web "occur continually".
Assistant Treasurer Michael Sukkar said the government treated the security of the data it collected "extraordinarily seriously".
"It's very alarming to me if any of that data is finding its way into hands that it shouldn't be," he told Sky News.
"Governments are going to have to be much better at protecting that data."
Labor opposition frontbencher Brendan O'Connor also pointed to the risk of a potential gross invasion of privacy.
"People are rendering up, yielding their personal information to government agencies - they don't expect them to be invaded or accessed so easily as this story would suggest."