Hack attack a hit to health

Medibank counts cost

MEDIBANK lost almost 13,000 customers in the three months to December 31 after it was the target of Australia’s biggest cyber heist, but the health insurer has returned to growth this month.

The company has so far spent more than $26m strengthening its cyber defences and for the first time has revealed how Russian hackers accessed its database of more than 9 million current and former customers.

It comes as Medibank’s interim net profit jumped 5.9 per cent to $233.3m, while revenue firmed 1.3 per cent to $3.63m.

The company confirmed on Thursday that the cyber criminals used a stolen Medibank username and passwords that were used by a third party IT service provider.

It then gained access to Medibank’s network via a “misconfigured firewall” that did not require an additional digital security certificate.

After Medibank refused to pay a $15m ransom, the hackers published the medical and claims data of policyholders on the dark web, most of which was difficult to understand.

As a result, the company lost almost 13,000 out of its 4 million policyholders in the December quarter. This suppressed policyholder growth in the first six months of the financial year, with the company writing 1700 new policies during the period.

But chief executive David Koczkar said the company was beginning to recover, with policyholder losses slowing to 1100 in January. It has recorded net growth of 200 so far in February.

“While we did see some impacts to resident policyholder growth in the second quarter, there are positive signs of recovery,” he said.

“With more normal business operations resuming in January, early signs of improvement in policyholder trajectory gives us confidence in regaining our growth momentum in the resident business.

“There is more work to do, and the lessons we have learnt from the cybercrime will continue to shape our response and we will emerge stronger.”

Medibank’s core health insurance business revenue rose 2.2 per cent to $3.54bn. Meanwhile, total claims paid increased 0.5 per cent to $2.9bn.

Medibank’s deferred claims liability, which is in recognition of claims that have likely been postponed since the beginning of pandemic restrictions, fell $36.7m to $411.6m.

Gross margin increased 100 basis points to 16.4 per cent and underlying gross margin increased 50 basis points to 15.3 per cent.

Revenue for Medibank Health – which includes its telehealth, hospital joint ventures and other medical services – dived 22.5 per cent to $92.8m. The division’s profit sagged 4.3 per cent to $24.6m.

Net investment income jumped nearly 81 per cent to $55.9m.

Medibank will pay an interim dividend of 6.3c a share, fully franked, on March 22.