Taking the Private Out of Medibank Private as Cyber Woes Get Worse

On Oct. 17, narrow-moat Medibank advised that there was no evidence customer data had been removed after the group detected unusual activity on its systems. On Oct. 19, Medibank shares were placed in a trading halt as the private health insurer was contacted by a suspect claiming to have stolen 200 gigabytes of data and provided a sample of 100 records with sensitive information. This included names, addresses, Medicare numbers, and even some claims data. Assuming this includes verification documents of a few megabytes each, we estimate this amount of data could easily encompass 30,000 policyholders. It could be a much higher number, but it is also possible the suspect only has data on the 100 revealed policyholders and is exaggerating its leverage over the insurer. But it remains too early to know.