Medibank, the health insurer, has incurred significant financial repercussions due to a data breach that occurred in 2022. According to the company’s recently released 2022-2023 annual report [pdf], the data breach cost Medibank a total of $46.4 million within the financial year. This amount encompassed expenses related to incident response and a customer support package.
Looking ahead, Medibank anticipates that the costs will continue to rise. The company projects an additional expenditure of $30 million to $35 million in 2024. These costs are attributed to various factors, including enhanced IT security measures, legal expenses, and other obligations related to regulatory investigations and potential litigation. However, these estimates do not encompass any potential impacts stemming from the ongoing regulatory investigations or litigation outcomes.
The data breach was first discovered in October 2022, when attackers gained access to the credentials of a third-party contractor. As a result, confidential information belonging to approximately 9.7 million customers was exposed.
Actions taken against key personnel within the organization
In response to the breach, Medibank took several measures. The company established a dedicated cyber response board committee, comprised of board chairman Mike Wilkins, CEO David Koczkar, and David Fagan, chair of the risk management committee. These individuals collaborated to develop a strategic plan to address the breach and its aftermath.
The annual report also highlights actions taken against key personnel within the organization. The CEO and other key management figures saw their short-term incentive payments reduced by a total of $2.6 million in connection with the incident.
Medibank is currently navigating regulatory inquiries and legal proceedings resulting from the breach. The Office of the Australian Information Commissioner is conducting a regulatory investigation, while the company faces up to three separate class action lawsuits. Notably, two customer-led class actions, represented by Baker McKenzie and Slater and Gordon, have merged into a single lawsuit. Additionally, shareholder lawsuits have been initiated by Quinn Emanuel and Phi Finney McDonald. An application has been submitted to consolidate these shareholder lawsuits into a single legal action.
The data breach has also prompted regulatory action. The Australian Prudential Regulatory Authority (APRA) initiated a targeted technology review and imposed an extra capital requirement of $250 million on Medibank as a consequence of the breach.
As Medibank continues to address the aftermath of the breach, the company is poised to grapple with ongoing financial and legal challenges. The total cost of the breach could escalate to over $80 million in the coming year, underscoring the extensive impact of cybersecurity incidents on organizations’ bottom lines.