Why corporate management is not being punished for cybercrime

First, it had the benefit of observing what Medibank and Optus did wrong in their response – and was versed on how to avoid some disclosure pitfalls.

Loading

Second, customer details that have been taken by the perpetrators appear to be mostly limited to driver’s licence details, which compared against sensitive medical records stolen from Medibank feels far less intrusive.

But the pathways followed in each instance are quite similar.

The scale and seriousness of the attack at Latitude has progressed with each announcement, but it was careful to avoid giving definitive statements from the get-go and, based on Wednesday’s update, it seems more people will be affected than its early estimate.

But rather than being freshly outraged by another cyber-incident, customers and investors seem to be taking the news in their stride.

For corporate victims there seems to be safety in numbers. Plus there is a bit of precedent.

Optus certainly lost customers to other telcos over the past six months, but the loss of accounts is not thought to have a long tail.

Optus’ parent, Singtel, noted in its half-year profit to September that it recorded a $140 million provision for a program of customer actions, including an external independent review, third-party credit monitoring services and the replacement of identification documents where needed.

The loss of any customers will not become evident until the March 2023 profit numbers are reported. However, Telstra’s December profit was boosted by additional customers migrating from Optus.

Loading

Medibank noted the loss of almost 13,000 resident policies in the second quarter (to December 2022) led to subdued growth of 1700 policyholders over the past six months.

But it also said: “With more normal business operations resuming in January, early signs of improvement in policyholder trajectory gives us confidence in regaining our growth momentum in the resident business. Last month net resident policyholder loss slowed to 1100, while this month up to 18 February we have seen net growth of 200.”

Medibank’s share price, which fell 20 per cent at the peak of the hack frenzy, has since retraced the majority of that fall.

Whether the cost of cyberattacks will move beyond losing market share and rectification will depend on whether mooted class actions from shareholders go anywhere.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.