Medibank has disclosed a breakdown of the $46.4 million in expenses incurred as a result of a high-profile cyber incident that occurred last year. The breach-related expenses comprise various categories, including administration expenses ($22 million), employee benefits expenses ($15.6 million), extra technology expenses ($7.5 million), and marketing expenses ($1.2 million).
These costs cover activities such as cybersecurity enhancements and legal costs related to regulatory investigations and litigation stemming from the breach.
Key Points
Direct Tech Costs: Medibank incurred $7.5 million in direct technology expenses in response to the cyber attack. These costs likely include investments in cybersecurity measures and remediation efforts.
Ongoing Costs: The company anticipates incurring an additional $30 million to $35 million in costs in the coming year. These expenses are expected to cover further IT security enhancements and legal expenses associated with regulatory investigations and litigation.
Excluded Penalties: The disclosed costs do not include potential penalties resulting from various regulatory and legal actions that are currently underway in connection with the data breach.
Independent Audit: PwC Australia independently audited Medibank’s annual report and noted the additional assurance work required due to the cyber incident. PwC had to assess whether the cybercrime event impacted the accuracy of Medibank’s financial reporting.
Data Breach Details: The October 2022 data breach at Medibank occurred when attackers obtained the credentials of a third-party contractor, resulting in the exposure of information on 9.7 million customers.
Medibank’s disclosure provides insight into the financial impact of a significant data breach, emphasizing the substantial costs associated with cybersecurity incident response, legal proceedings, and regulatory investigations.