‘This is a business for them’: Why Medibank should have paid the hackers

Share:

Medibank should have negotiated and paid the ransom demanded by hackers after its data systems were breached exposing the details of almost 10 million current and former customers, argues a cybersecurity expert.

Chris Rock, a professional hacker who co-founded global company SIEMonster, which is based in New York and has partnerships with Amazon and Oracle, says the hackers that Medibank are negotiating with are, like it or not, business people.

“They are not just one-time wonders, this is a business for them,” says Rock, who is an Australian. He argues that once a ransom is paid it’s not in the hackers’ interest to leak the information. And while there is no guarantee, Rock says if the hackers leak the information after receiving payment, then the next company they target won’t pay.

Rock, who for the past three decades has worked for governments, universities, and companies such as Australia’s BlueScope Steel, says he knows his view is in the minority.

The board and management of Medibank, Australia’s largest health insurer with 27.3 per cent of the market, have refused to pay the hackers the $US9.7 million ($14.6 million) ransom they demanded. The federal government and its security agencies also advised against payment.

Since the attack by Russian hackers was made public in mid-October, the personal information and health conditions of some Medibank customers have been released in batches on the dark web. This has included information on Medibank customers who have had abortions and received treatment for mental health conditions. The hackers released a further block of customer records on the weekend, which included details on chronic conditions such as heart disease, and details of people with cancer, dementia, and infections.

Medibank was verifying those recent records that were released. The company’s chairman, Mike Wilkins, and chief executive David Koczkar have issued a number of apologies to customers.

“I understand the [Medibank] CEO making the grand statement that we don’t want to pay. I think it was the wrong move,” says Rock. “Even though the hackers want $15 million, you negotiate with them. It’ll end up at like seven million. You’ve got a 50-50 chance that it doesn’t get leaked. I know the [Medibank CEO’s] stance is a very moralistic stance, but he’s holding everybody else hostage, whether you’ve had an abortion or whether you got mental health issues. It’s stuff you don’t want out in the public and there’s a lot of people that hide that stuff from employers.”

Advertisement

Rock has negotiated on behalf of corporations that have been the subject of such a cyberattack. “I’ve done deals for corporates before who don’t want to touch this because it’s too messy, where I’ve had to purchase not so much data back, but when data gets ransomwared I negotiate and send bitcoin to these people, get that data released or unencrypted.”

Medibank chair says company’s cybersecurity was ‘clearly not robust enough’

Bloomberg Intelligence analysts have estimated that the hack could cost Medibank $700 million if customers sue for damages. This figure could rise to $960 million if 10 per cent of affected customers join a class-action lawsuit and are paid the maximum $20,000 in damages, it said.

There are at least two potential class actions being pursued – by Bannister Law Class Actions and Maurice Blackburn. Medibank also faces the risk of fines, and a $35 million bill to rectify its computer systems after the security breach.

https://www.smh.com.au/business/consumer-affairs/this-is-a-business-for-them-why-medibank-should-have-paid-the-hackers-20221121-p5bzzn.html

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
1:32 pm, Jul 11, 2025
weather icon 30°C
L: 28° | H: 32°
few clouds
Humidity: 41 %
Pressure: 1020 mb
Wind: 6 mph ENE
Wind Gust: 9 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 13%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:56 am
Sunset: 9:15 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
28° | 32°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
18° | 30°°C 0 mm 0% 9 mph 65 % 1018 mb 0 mm/h
Sun Jul 13 10:00 pm
weather icon
17° | 27°°C 0 mm 0% 7 mph 73 % 1014 mb 0 mm/h
Mon Jul 14 10:00 pm
weather icon
20° | 29°°C 0 mm 0% 14 mph 71 % 1017 mb 0 mm/h
Tue Jul 15 10:00 pm
weather icon
15° | 27°°C 0 mm 0% 13 mph 71 % 1021 mb 0 mm/h
Today 4:00 pm
weather icon
31° | 31°°C 0 mm 0% 5 mph 36 % 1019 mb 0 mm/h
Today 7:00 pm
weather icon
28° | 29°°C 0 mm 0% 5 mph 32 % 1018 mb 0 mm/h
Today 10:00 pm
weather icon
22° | 22°°C 0 mm 0% 8 mph 47 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
18° | 18°°C 0 mm 0% 4 mph 55 % 1018 mb 0 mm/h
Tomorrow 4:00 am
weather icon
19° | 19°°C 0 mm 0% 4 mph 65 % 1018 mb 0 mm/h
Tomorrow 7:00 am
weather icon
19° | 19°°C 0 mm 0% 6 mph 64 % 1018 mb 0 mm/h
Tomorrow 10:00 am
weather icon
24° | 24°°C 0 mm 0% 6 mph 45 % 1017 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
28° | 28°°C 0 mm 0% 7 mph 30 % 1015 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€100,979.92
6.47%
Ethereum(ETH)
€2,555.34
7.74%
Tether(USDT)
€0.86
-0.01%
XRP(XRP)
€2.26
7.92%
Solana(SOL)
€140.32
4.29%
USDC(USDC)
€0.86
-0.01%
Dogecoin(DOGE)
€0.170457
10.61%
Shiba Inu(SHIB)
€0.000011
8.20%
Pepe(PEPE)
€0.000011
15.71%
Peanut the Squirrel(PNUT)
€0.248573
19.26%
Scroll to Top