It’s been something of a rollercoaster for Medibank with its recent cyber attack.

First they told the market that they’d had an attack, but they’d contained it and no customer data had been accessed.

Then a few days later they restated that was no evidence that customer data had been stolen:

They had restored the systems on new hardware, and operations had resumed. The stock fell about 4% over this period, then recovered.

But yesterday, the company indicated that they had been contacted by someone claiming they had stolen data. Medibank put out another release saying they were investigating, and this afternoon they issued a statement that confirmed some information had been stolen.

The company has also mentioned numerous times that its systems have not been encrypted by ransomware. (That is, the hacker has not been able to scramble all the data in the systems and demand payment for the secret codes required to unscramble them.)

Current position

It now seems very likely that a hacker did gain access to their systems and was able to take some information relating to customer accounts in their ahm and international student brands. It appears the hacker waited a week before releasing this information, so presumably, they were attempting to gain more leverage but now think that their best option is trying to embarrass Medibank into paying some kind of a ransom.

So Medibank’s systems are all working, but someone has data they shouldn’t. This includes names and contact details, birth dates, Medicare numbers, and some codes relating to claims which could be used to discover medical procedures people have had and some diagnoses.

The affected customers are probably mainly with Medibank’s ahm brand. The international student business would be minor, and there’s been no mention of a breach relating to Medibank’s main brand. ahm customers make up about a quarter of the book, and although the company does not provide segmental information, it seems likely that the average revenue per policyholder is lower for ahm than the Medibank brand, given that ahm is aimed at younger people.

The attacker has threatened to release more data unless Medibank pays up.

Outlook

It’s not illegal for Medibank to pay up, but it’s strongly discouraged by the authorities and the security community for the obvious reason that it just encourages more attacks, and there’s no guarantee the data would not be shared anyway. So it’s unlikely that they’ll make a payment. The demands from the hacker suggest that whatever back door they had into Medibank is now very firmly closed, so further disruption to Medibank’s systems is unlikely.

Unfortunately for the affected customers, they will likely have to monitor their various accounts and possibly change their credit cards.

Medibank will likely be fined for this breach, but (as the minister complained during the Optus breach recently), the fines are currently fairly modest. But it does support the government’s calls for stiffer penalties for companies that allow unauthorised access to data. Unlike the Optus breach, there’s been no suggestion that Medibank was holding on to information that it didn’t need (in contravention of the national privacy principles).

Clearly, it’s not a positive for Medibank, and there will be costs related to remediation and fixing the security breaches, and they will lose some policyholders at the margin. But Australia’s health system is still strongly geared towards encouraging people into the private health insurance market, and switching health insurers is difficult. Combined with the fact that insurance is one of the very few sectors of the economy that benefit from higher interest rates and has defensive earnings that are not strongly affected by inflation or recession fears, we’ll continue to hold the stock.