APRA takes action against Medibank over October ransomware attack

Tuesday, 27 June 2023 11:41

APRA takes action against Medibank over October ransomware attack Featured

By Sam Varghese

Image by Gaby Stein from Pixabay

Medibank Private will face an increase of $250 million in its capital adequacy requirement from 1 July, with the Australian Prudential and Regulation Authority imposing the increase after a review of the cyber attack on the medical insurance provider last year.

In a statement on Tuesday, APRA said the additional amount reflected weaknesses identified in Medibank’s information security environment.

Medibank announced on 14 October 2022 that its systems had been breached. Thereafter, information slowly trickled out until the company finally admitted that the date of 9.7 million past and present customers could have been accessed.

The APRA statement said the capital adjustment would be applied to Medibank’s operational risk charge under the new Private Health Insurance Capital Framework.

"It will remain in place until an agreed remediation program of work is completed by Medibank to APRA’s satisfaction. APRA will also conduct a targeted technology review of Medibank, with a particular focus on governance and risk culture," the statement added.

The regulation body said while Medibank had addressed specific control weaknesses which led to the incident, it had more work to do to further strengthen its security environment and data management.

APRA member Suzanne Smith said the Medibank cyber incident was one of the more significant data breaches in Australia.

“In taking this action, APRA seeks to ensure that Medibank expedites its remediation program,” Smith said. “This action demonstrates how seriously APRA takes entities’ obligations in relation to cyber risk and that APRA will respond strongly to identified weaknesses in cyber-security controls.

“As noted previously, APRA expects Medibank to ensure there is appropriate accountability and consequence management, including impacts to executive remuneration where appropriate. I note that Medibank has consistently dealt with APRA in an open, constructive and co-operative way, consistent with our expectation of all regulated entities.

“Since launching the 2020-2024 Cyber Security Strategy, APRA has repeatedly stressed the importance of an uplift in cyber security and continued vigilance to identify and address cyber exposures.

"Unfortunately, not all entities are heeding these messages as we continue to identify poor cyber security practices and inadequate oversight from boards and management,” Smith said.

In response, Medibank said in a note sent to the ASX that it had sufficient capital to meet the increase.

It said after application of this requirement the company would remain well capitalised with unallocated capital remaining at 30 June 2022 levels: $148 million. Given this, the company said it would not reduce its target health insurance required capital ratio.

Medibank chief executive David Koczkar said: "Safeguarding customer data is a responsibility Medibank takes very seriously.

“Medibank has continued to strengthen our systems and processes to provide our customers with the security they expect and deserve. We will continue to work to enhance our systems and processes even further. Our company remains strong and well capitalised.

“We continue to support our customers through the Medibank Cyber Response Support Program, which includes mental health and well-being support, identity protection and financial hardship measures.”

Read 105 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here

GARTNER MARKET GUIDE FOR NDR 2022

You probably know that we are big believers in Network Detection and Response (NDR).

Did you realise that Gartner also recommends that security teams prioritise NDR solutions to enhance their detection and response?

Picking the right NDR for your team and process can sometimes be the biggest challenge.

If you want to try out a Network Detection and Response tool, why not start with the best?

Vectra Network Detection and Response is the industry's most advanced AI-driven attack defence for identifying and stopping malicious tactics in your network without noise or the need for decryption.

Download the 2022 Gartner Market Guide for Network Detection and Response (NDR) for recommendations on how Network Detection and Response solutions can expand deeper into existing on-premises networks, and new cloud environments.

DOWNLOAD NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!