The Medibank Private Ltd (ASX: MPL) share price is plummeting 15% as the company returns to trade on news a continuously worsening cyberattack will likely bite into its financial year 2023 (FY23) earnings.
The company has confirmed a hacker gained access to the personal data and "significant amounts" of medical-related data of all Medibank, international student, and ahm customers.
Medibank – which doesn't have cyber insurance – estimates the attack could dint its bottom line by between $25 million and $35 million. The company has also withdrawn its FY23 policyholder growth outlook on the back of the attack.
The Medibank share price is plummeting 14.69% to $2.99 in late morning trade on Wednesday.
Let's take a closer look at what's going on with the S&P/ASX 200 Index (ASX: XJO) health insurer today.
Medibank share price tumbles 15% on return to trade
The Medibank share price is tumbling in its return to trade on Wednesday – the first time it's moved in around a week.
The stock was frozen last Wednesday while the company continued to work on understanding the unfurling cyberattack and informing the market and its customers.
A cybercriminal was previously found to have removed some data from the company's systems.
Medibank believes they have likely stolen additional data, meaning the number of impacted customers could soar.
However, it doesn't yet think its systems have been encrypted by ransomware. The company is prioritising the prevention of further unauthorised access to its network and monitoring for further activity.
The Australian Federal Police (AFP) is also investigating the hack. Medibank continues to work with the AFP, specialised cybersecurity firms, and the Australian Cyber Security Centre.
Medibank CEO David Koczkar commented in Wednesday's release, saying:
I apologise unreservedly to our customers. This is a terrible crime – this is a crime designed to cause maximum harm to the most vulnerable members of our community.
Guidance update
The Medibank share price could also be feeling the impact of the company's newly-revised guidance.
The company estimates the cyberattack will drag on its first half earnings – likely costing $25 million to $35 million pre-tax. Such non-recurring costs doesn't include the potential for further remediation, regulatory, or litigation-related costs.
It has also scrapped its net resident policyholder growth guidance following the cyberattack.
Though, it said its policyholder growth for the September quarter was 14,600. That represents a rolling 12-month growth rate of 3.2% – above the 2.7% growth previously expected.
Yesterday, the company committed to defer premium increases for Medibank and ahm policyholders until 16 January. The resulting cost will be partially offset by savings brought about by lower-than-expected underlying net claims expenses, bolstering the company's savings to around $62 million.
Medibank's health insurance capital ratio was 13.4% as of 30 September and its unallocated capital was around $150 million.
