Medibank Private Ltd (ASX: MPL) shares have taken a hit in trading on Wednesday after the company announced the Australian Information Commissioner (OAIC) has commenced civil penalty proceedings against it in Federal Court.
The proceedings are in relation to the 2022 "cybercrime event", the company says, and relate to the Commissioner's own investigation into the event.
Medibank shares are currently trading at $3.69 apiece, down nearly 2%. Let's take a look at what this means for the insurer.
Medibank shares hit over huge potential fines
The 2022 cyber attack on Medibank and its subsidiary AHM resulted in the exposure of sensitive customer data.
Hackers released information on the dark web, including details about names, addresses, dates of birth, phone numbers, and email addresses.
Other compromised data included Medicare numbers and, in some cases, passport numbers for international students. Medibank, following federal government advice, chose not to pay the ransom demanded by the hackers.
Maurice Blackburn Lawyers lodged a representiative complaint against Medibank, which the OAIC accepted on March 30, 2023.
In its latest submission, the OAIC alleges that Medibank "seriously interfered" with the privacy of 9.7 million Australians by "failing to take reasonable steps to protect their private information", according to reporting by The Australian.
The OAIC is seeking penalties for each of the 9.7 million affected customers, with each contravention carrying a maximum fine of $2.22 million, The Australian Broadcasting Corporation reports.
Tallied up, this totals a staggering maximum amount of $21.5 trillion, the ABC says. However, the actual fines will be determined by the Federal Court. It is unsure how the Court will decide proceedings if ruling in favour of the Commonwealth.
Implications for Medibank shares
In today's announcement, the ASX healthcare share stated its intent to defend the OAIC's claims. Still, the breach has placed Medibank under scrutiny. If unsuccessful in its defence, who knows what the financial and reputational outcome of this will be.
Whilst there are no specific fine amounts listed, a maximum of $21.5 trillion is a staggering amount, more than the entire Australian GDP of US$1.7 trillion in 2023.
Medibank's revenues were up 1.3% to $3.65 billion in H1 FY 2024. The company reported a net profit after tax (NPAT) of $233.3 million, up 6% year over year.
This was after "cybercrime costs" of $17.6 million for the period, adding to the $26.2 million the prior corresponding period.
What does this mean for investors? Well, given it is still early days, we are yet to find out. The market has yet to fully digest the news as well. Safe to say however – this is one to keep a close eye on.
Conclusion
Medibank investors have taken the news reasonably well today. The Medibank share price is down around 2% at the time of writing. In the last 12 months, the stock is up around 4%. It has climbed 4% this year to date as well.
While the exact financial impact remains uncertain, investors would be wise to stay informed about the proceedings and their potential implications for Medibank's future performance.
