Medibank says it won’t pay cyber ransom

Medibank Private says it will not pay a ransom to the hackers who accessed personal information on all 4 million of its customers, and an unknown number of former members.

“Based on the extensive advice we have received from cybercrime experts we believe there is only a limited chance paying a ransom would ensure the return of our customers’ data and prevent it from being published,” Medibank chief executive David Koczkar said in a statement on Monday morning.

“In fact, paying could have the opposite effect and encourage the criminal to directly extort our customers, and there is a strong chance that paying puts more people in harm’s way by making Australia a bigger target.”

“It is for these reasons we have decided we will not pay a ransom for this event.”

Cybersecurity Minister Clare O’Neil has said previously that the federal government is against the payment of cybercrime ransoms, but confirmed it is not illegal.

“The formal advice of the Australian Government is don’t pay ransoms,” O’Neil has said.

“These people are hard criminals and they are dishonest. They’ll tell you all sorts of things about what will happen in the aftermath of paying a ransom and by nature these people are liars and we suggest not co-operating with them.“

Medibank first revealed the cyber incident last month, but initially said there was no evidence customer data had been accessed. This escalated the following week when Medibank received a ransom note from the hackers which was also sent to the Sydney Morning Herald and The Age.