APRA takes action against Medibank for cyber incident

Oksana Patron

27 June 2023

The Australian Prudential and Regulation Authority (APRA) has taken action against Medibank Private, following its review of its major cyber incident in October 2022, and will impose an increase in its capital adequacy requirement of $250 million, reflecting identified weaknesses in Medibank’s information security environment.

The capital adjustment, effective from 1 July 2023, will be applied to Medibank’s operational risk charge under the new Private Health Insurance (PHI) Capital Framework and it will remain in place until an agreed remediation program of work is completed by Medibank to APRA’s satisfaction.

APRA also said it would conduct a targeted technology review of Medibank, with a particular focus on governance and risk culture.

APRA Member Suzanne Smith said the October 2022 cyber incident affecting Medibank customers was one of the most significant data breaches ever experienced in Australia.

“This action demonstrates how seriously APRA takes entities’ obligations in relation to cyber risk and that APRA will respond strongly to identified weaknesses in cyber security controls,” Smith said.

“As noted previously, APRA expects Medibank to ensure there is appropriate accountability and consequence management, including impacts to executive remuneration where appropriate. I note that Medibank has consistently dealt with APRA in an open, constructive and cooperative way, consistent with our expectation of all regulated entities.

“Since launching the 2020-2024 Cyber Security Strategy, APRA has repeatedly stressed the importance of an uplift in cyber security and continued vigilance to identify and address cyber exposures.  Unfortunately, not all entities are heeding these messages as we continue to identify poor cyber security practices and inadequate oversight from boards and management.”