The government found itself facing heavy criticism this week over how it handles Australians’ personal information, after a Guardian investigation revealed a darknet trader was illegally selling the details of any Medicare card holder on request by “exploiting a vulnerability” in a government system.

The data had been for sale since at least October 2016, and the seller appears to have sold the Medicare details of at least 75 Australians.

The human services minister, Alan Tudge, admitted he and his department had only become aware of the breach when contacted by Guardian Australia. Nobody from his department – or apparently from the Australian security services – appears to have been actively monitoring this posting on the darknet auction site.

This is just the latest data security and privacy scandal to rock the Australian government. While it has tried to reassure the public, there has been a flurry of concern about Medicare, health data and the use and storage of Australians’ personal information more broadly.

It comes off the back of a string incidents including the census debacle, malware attacks and other high-profile hacking attempts that have served to undermine confidence in the government’s handling of information.

“What’s happening is the community is wrapping these attacks together and seeing them as a threat, and it adds to a perception that their data is not safe,” said Australia’s privacy commissioner, Timothy Pilgrim. “All the players need to work out a way to build up that trust.”

But why do these breaches keep happening? And is the government doing everything it can to stop them, and reassure the public when they do happen?

After being alerted by the Guardian to the Medicare breach, the minister took swift action, referring it to the Australian federal police for investigation. Pilgrim welcomed this as an appropriate response.

Tudge also did several interviews, seeking to reassure Australians that their actual medical records stored online as part of the My Health Record system had not been compromised.

These were useful and important clarifications. But they missed the main risk of this breach, and the opportunity to curb similar incidents.

The most critical risk to Australians from the misuse of Medicare card data is one of identity fraud. A fake Medicare card with legitimate details can get a criminal a quarter of the way to an entire fake ID. This could then be used by organised crime groups in any number of ways, for example by leasing property or equipment. It could also be used to fraudulently obtain services from Medicare itself.

In this case, the darknet was the vehicle for this particular identity fraud scam. But it didn’t need to be, and it is likely similar, less-sophisticated scams are taking place right now.

Tudge has used an unusual line to explain the breach. He has said it was not a hack or cyber attack, but “traditional criminal activity”. What he’s edging around is that his department believe this was a case of an individual using a legitimate method to access Medicare data – but for an unauthorised and illegal purpose.

But contrary to Tudge’s assertion, access control is very much a matter of cybersecurity. And there are a lot of problems with the way Medicare card details can be obtained.

For instance more than 200,000 individual users can potentially look up Medicare card details through the department’s system. The department has declined to answer whether each access is logged, which could allow it to trace when a particular card was looked up. If those controls aren’t there, it’s unlikely the darkweb vendor selling this data will be found.

It doesn’t mean someone sitting in a doctor’s clinic has been supplying the data. A prospective patient could show up at a GP’s reception, pretending to be someone else, and just ask for that person’s Medicare card details. Guardian Australia has spoken with one employee at a medical practice who said people regularly asked for their card details to be supplied.

Identity fraud using Medicare cards is coming to be seen as a big problem in the government. The human services department acknowledged in February 2016 that there had been 1,500 “probable” cases of Medicare fraud, a jump from 269. The Australian reported that in 2014 the justice minister, Michael Keenan, set out to quantify the scale of Medicare card fraud taking place. A study found Medicare cards and driving licences were the mostly commonly used forms of ID for fraudsters.

The problem appears to be growing worse as those given credentials to access Medicare card details legitimately has increased – jumping 25% in the last financial year – and as organised crime groups grow more sophisticated in their methods.

All of this contributes to the loss of trust.

“All-too-regular data breaches from government agencies over recent years have undermined trust in the ability of government to protect our information and threaten to derail plans for increasing the use of online service delivery,” said Jon Lawrence of Electronic Frontiers Australia.

So how should the government stop them, and how can it rebuild trust in the handling of information, particularly Medicare data?

One temporary fix could be to remove Medicare cards from the list of documents that can be used to verify an Australian’s identity. And for a short time, it looks as though that’s exactly what the government was doing.

On Wednesday the Australian Taxation Office issued an advisory to staff that said it had suspended the use of Medicare cards for the purposes of identification verification for Australians’ tax matters.

An internal memo seen by the Guardian said: “As a result of recent media coverage on Medicare card details being sold on the ‘dark web’, the Medicare card has been removed from the list of DVS (Document Verification Service) documents until further notice.”

The DVS is managed by the Attorney General’s Department and is used by a range of federal and state government agencies. The ATO’s advisory strongly indicated that the department had made this change.

If it were implemented, it would have had immediate ramifications for how all these agencies responded to queries from Australians and carried out their ID checks. And it also would have eliminated at least some of the identity fraud risks surrounding Medicare cards.

But after the ATO was contacted by Guardian Australia, its advisory was quietly revoked. Tudge issued a statement that said Medicare cards would continue to serve as legitimate forms of ID.

No explanation has been given by the tax office for the reversal. It remains unclear whether it was acting on the advice of the Attorney General’s Department. These questions will undoubtedly be canvassed if the Greens leader, Richard Di Natale, succeeds in his push for a Senate inquiry into the debacle.

But it feels like a missed opportunity to take decisive action and reassure Australians that their personal information is safe. And to rebuild some of the trust the government has lost in the way it handles personal data.