Medibank, the Australian insurer, will undergo a “targeted technology review” by the financial regulator APRA and must hold additional capital as it addresses weak controls that contributed to a data breach last year.
APRA has decided to impose a $250 million increase in Medibank’s capital adequacy requirement after reviewing the cyber incident.
Requiring additional capital is a common short-term penalty imposed in response to incidents.
The increased capital requirement will remain in place until Medibank completes an agreed-upon remediation program to APRA’s satisfaction, specifically regarding information security controls.
Although the vulnerability behind the data breach has been resolved, APRA stated that Medibank still needs to strengthen its security environment and data management in several areas.
APRA also urges Medibank to expedite its remediation program.
Furthermore, APRA will conduct a targeted technology review of Medibank, focusing on governance and risk culture. The timeline for this review is currently unclear.
Medibank confirmed that it has sufficient capital to meet the capital adjustment and will support APRA’s efforts, collaborating on the remediation program.
The data breach impacted approximately 9.7 million customers, and Medibank previously estimated direct costs related to the breach to reach $40 million.
