Medibank has revealed all of its 3.9 million customers have had their data exposed to a hacker, in a significant escalation of the cyber-attack on the Australian health insurer.
In an update to the Australian Stock Exchange on Wednesday, the company said that since Tuesday’s announcement that all customer data may have been exposed, the investigation into the breach has now established the hacker had access to all Medibank, ahm and international student customers’ personal data, and significant amounts of health claims data.
The personal information includes name, address, date of birth, some Medicare card numbers and gender. The health information includes the claim codes made by customers.
Medibank still cannot say definitively how many or which customers are affected beyond the 1,000 records provided to the insurer by the hacker in the past two weeks. It is through this communication with the hacker that Medibank has been able to determine the extent of the breach so far.
The breach will also affect former customers, with Medibank confirming yesterday that state and territory health record laws require the company to keep data for seven years.
Customers will be provided a hardship financial support package if they are in a “uniquely vulnerable position” as a result of the hack, and Medibank says it will reimburse customers for costs associated with the reissuing of ID documents for those that were compromised in the hack.
The hack is likely to cost the company a minimum between $25m and $35m, Medibank said. This is due to Medibank not having cyber-attack insurance, and this estimated cost does not include customer compensation or regulatory or legal costs that may be brought against the company.
Medibank is in communication with the hacker – who obtained stolen Medibank credentials from another hacker on a Russian cybercriminal forum – but the company has declined to say whether it would pay any ransom demands made.
In a call with investors on Wednesday, Medibank’s head of technology and operations, John Goodall, said that the company had deployed monitoring tools on its network and those tools suggest that the hacker is no longer in the company’s systems.
Medibank’s chief executive, David Koczkar, said there was no evidence that credit card information had been compromised but he would not rule it out.
“We have no evidence that credit card data has been removed,” he said. “But I will be very clear to say we are continuing to investigate. And as soon as it becomes clear to us if that changes, we will make it clear.”
He said the information the company has been able to obtain about the attack has been through communications with the hacker, who showed evidence of records obtained.
In a statement to the stock exchange, Koczkar apologised unreservedly to customers.
“This is a terrible crime – this is a crime designed to cause maximum harm to the most vulnerable members of our community.”
Medibank announced on Tuesday it would delay premium increases for all customers until the end of January 2023. On Wednesday, the company said this would cost around $62m, which would be offset by savings the company has made during the Covid-19 pandemic.
The hack is under investigation by the Australian federal police.
