“The investigation into this cybercrime event is continuing, with particular focus on what data was removed by the criminal.”

“As we’ve continued to say we believe that the scale of stolen customer data will be greater, and we expect that the number of affected customers could grow substantially.”

Koczkar declined to say if Medibank has received a ransom demand from the hackers, citing the ongoing investigation by the Australian Federal Police.

He did confirm to this masthead that communications with the hacker have resulted in the company receiving a number of files.

“I would say we received a series of files,” he said without clarifying further. “The two files that we’re sure about, that we have talked about, impacts 1,100 AHM customers and includes their personal and some health claims data. There are a whole series of other files, some of which don’t include anything, some of which include some personal and health claims data.“

The stolen data is from current and former customers and includes names, addresses, birthdates, Medicare numbers, contact information and claims data from the private health insurer. The list of Medibank customers affected potentially includes high-profile Australians.

The hackers have also claimed to possess credit card information, although Medibank said there was no evidence - at this stage - that this is the case, but emphasised that its investigations are continuing.

Medibank announced a support package for affected customers, which includes hardship provisions to provide financial assistance to customers who are in a uniquely vulnerable position as a result of this crime. It is also allowing access to Medibank’s mental health and wellbeing support line for all customers, including customers of its budget ahm service.

Loading

The group is also giving affected customers access to specialist identity protection advice and resources from IDCARE, free identity monitoring services for customers who have had their primary ID compromised and reimbursements for the “re-issue of identity documents that have been fully compromised in this crime.”

Koczkar responded to criticism about whether the company should have been clearer last week about the potential damage from the cyber incident.

“We’ve shared what we could when we can share it, and that does involve incomplete information. Things are moving very fast. But I’m going to maintain that commitment, that as soon as things become clear to me, we will share it.“

More to come