Expert says Medibank should pay ransom as all customer's data exposed

As all Medibank customers, including ahm and international, had their personal data exposed to hackers, an expert says the health insurance giant should pay the ransom.

Professor Richard Buckland said with all the sensitive medical data compromised in the cyber attack, it might be better to pay the ransom.

"I can't believe I'm saying this but it might be one of those cases where it might be better if the ransom was paid," Buckland said.

READ MORE: Federal Budget 2022: Winners and losers

The insurer's response to the cyber attack will cost anything up to $35 million but potential lawsuits and penalties could blow the figure out.

It comes as Medibank revealed this morning all four million of its customer's personal and sensitive health data has been accessed by hackers.

"Our investigation has now established that the criminal had access to all ahm customers' personal data and significant amounts of health claims data; all international student customers' personal data and significant amounts of health claims data; all Medibank customers' personal data and significant amounts of health claims data," Medibank said in a statement.

"As a result, we expect that the number of affected customers could grow substantially."

Medibank said its IT systems had not been encrypted by ransomware yet, and customers could continue to access health services.

Support for affected customers includes individual "hardship packages" for customers left in a "uniquely vulnerable" decision, free identity monitoring for customers who have had their identity compromised, and free re-issues of compromised documents.

READ MORE: When life will get cheaper for millions of Aussies

Yesterday, Cyber Security Minister Clare O'Neil said the damage from the hack was "potentially irreparable."

"Australians who are struggling with mental health conditions, drug and alcohol addiction, with diseases that carry some shame or embarrassment, they are entitled to keep that information private and confidential," she said.

READ MORE: What Medibank customers need to know after cyberattack and ransom threat

"For a cybercriminal to hang this over the heads of Australians is a dog act. It is scum of the earth, lowest of the low territory."

The AFP is continuing to investigate the incident.

Meanwhile, Optus, who was also the subject of a major cyber attack where the data of 2.1 million customers was compromised, has told its customers how successful it was against hackers.

A gloating message read "we went public early... we engaged with government quickly... we listened, we learned and we responded in real time".

EXPLAINED: What to do if you have been hacked

View gallery

Can you pick the Black Friday scam text message?