Medibank Hack: A$700 Million in Compensation and Fixes Needed

The potential cost of the data breach at Medibank Private Ltd. could be huge, with Bloomberg Intelligence estimating that it could reach A$700 million ($450 million) if customers decide to sue for damages. The breach occurred when personal medical details were posted to a forum on the dark web, meaning that the information is potentially accessible to anyone. This could have serious implications for the privacy and security of Medibank customers.

The amount of customer damages awarded is the key variable in the ultimate cost of Medibank's data breach, BI analyst Matt Ingram wrote in a note Thursday. The compensation bill could run as high as A$960 million if 10% of affected customers join a mooted class-action lawsuit and are paid the maximum A$20,000 in damages, but BI's base case is A$480 million, he said.

If the insurer is found liable, they could face significant fines, while the cost of fixing the issue could be more than double the A$35 million charge Medibank has already flagged, according to Ingram. While these damages could pose a significant blow to 2023 earnings, they shouldn’t prompt a capital raise, he said.

Hackers have begun leaking data stolen from Medibank, including the names, addresses and birthdates of hundreds of customers, to a forum on the so-called dark web. More details were posted on Thursday, and the company expects further leaks. The hackers have demanded a ransom of $10 million for the data, according to the Australian Financial Review.

The hack at Medibank follows a vast data leak at Singapore Telecommunications Ltd.'s Optus unit in September, which exposed the details of as many as 10 million customers. In Singtel's earnings Thursday, it said it had provisioned a further S$142 million ($101 million) for customer remediation efforts.