The federal government has exercised  its cyber sanctions powers for the first time after identifying a man linked to a catastrophic attack on Medibank.

The government says the Australian Signals Directorate (ASD) and the AFP have linked Russian man Aleksandre Ermakov to the attack last year, in which almost 10 million records including names, dates of birth, Medicare numbers and sensitive medical information was stolen.

Foreign Minister Penny Wong said the government had used its autonomous cyber sanctions framework to slap financial sanctions and a travel ban on Ermakov.

“This is the first time Australia’s autonomous cyber sanctions have been used,” she told a media conference.

It is now a criminal offence, punishable by up to 10 years’ imprisonment and heavy fines, to provide assets to Ermakov or to use or deal with his assets, including through cryptocurrency wallets or ransomware payments.

Ermakov is also banned from travelling to, or remaining in, Australia.

A commitment to use sanctions to respond to malicious cyber activity is contained in the 2023‑2030 Australian Cyber Security Strategy.

The government would continue to hold cyber criminals to account, Senator Wong said.

“This is an incredible effort from our cyber and intelligence teams. We are using all elements of our national power to make Australia more secure at home and to keep Australians safe,” she said.

Deputy PM Richard Marles said the sanctions were a “significant and unprecedented step” and paid tribute to the professionalism and skill of the ASD during its 18 month investigation.

Investigators were continuing to pursue a range of leads in relation to the attack, he said.

Home affairs minister Clare O’Neil described the Medibank attack as “the single most devastating cyber attack that we have experienced as a nation.”

She told journalists the sanctions were part of a wider suite of efforts against known Russian cyber gangs which the ASD is focused on disrupting.