Medibank says all 3.9m customers could be affected by data breach

Medical insurer Medibank Group says all of the 3.9 million customers of its main business could now be assumed to be affected by the theft of data, even as it prepared for a resumption of trading.

In a statement on Wednesday, the company said it expects to spend up to $35 million on non-recurring costs due to the network attack it has suffered, not including potential customer and other remediation or legal costs.

“This cyber crime event continues to evolve and at this stage, we are unable to predict with any certainty the impact of any future events on Medibank, including the quantum of any potential customer and other remediation, regulatory or litigation related costs,” the company said.

When it first announced its systems had been breached, it said there was no indication of any sensitive data having leaked. Later, Medibank said the data stolen was limited to ahm and international students.

The company said it had withdrawn its full-year 2023 outlook for policy-holder growth and would update this when it issued results for 1H23.

Until this point, policy holder grown had been tracking at 3.2%, slightly above the FY23 outlook of 2.7%, it added.

The company said underlying net claims per resident policy were below the FY23 outlook of 2.3% and given that an additional saving of $62 million was achieved due to COVID-19, this would offset the deferral of premium increases for Medibank and ahm customers to 16 January.

Chief executive David Koczkar said: “Our investigation has now established that this criminal has accessed all our private health insurance customers personal data and significant amounts of their health claims data.

“The investigation into this cyber crime event is continuing, with particular focus on what data was removed by the criminal.

“As we’ve continued to say we believe that the scale of stolen customer data will be greater and we expect that the number of affected customers could grow substantially.

“I apologise unreservedly to our customers. This is a terrible crime – this is a crime designed to cause maximum harm to the most vulnerable members of our community.”

The insurers announced a support package for affected customers:

• “A hardship package to provide financial support for customers who are in a uniquely vulnerable position as a result of this crime, who will be supported on an individual basis;
• “Access to Medibank’s mental health and wellbeing support line for all customers, including ahm customers;
• “Access to specialist identity protection advice and resources from IDCARE;
• “Free identity monitoring services for customers who have had their primary ID compromised; and
• “Reimbursement of fees for re-issue of identity documents that have been fully compromised in this crime.”

The Medibank breach is one of eight to be reported in the space of a month, the others being Optus, Telstra, G4S, Costa Group, Dialog, MyDeal and EnergyAustralia.

GET READY FOR XCONF AUSTRALIA 2022

Thoughtworks presents XConf Australia, back in-person in three cities, bringing together people who care deeply about software and its impact on the world.

In its fifth year, XConf is our annual technology event created by technologists for technologists.

Participate in a robust agenda of talks as local thought leaders and Thoughtworks technologists share first-hand experiences and exchange new ways to empower teams, deliver quality software and drive innovation for responsible tech.

Explore how at Thoughtworks, we are making tech better, together.

Tickets are now available and all proceeds will be donated to Indigitek, a not-for-profit organisation that aims to create technology employment pathways for First Nations Peoples.

Click the button below to register and get your ticket for the Melbourne, Sydney or Brisbane event

GET YOUR TICKET!