Medibank commits another $125m in cash-backs, but stares down another class action over cyber breach

Health insurer Medibank (ASX: MPL) just can't catch a break this week. First it was slogged with a $250 million hike to its capital risk buffer requirements due last year's cyber breach, and today it was ingratiating customers with a $125 million cash-back program only to find that it would be facing yet another class action.

After the company's cyber security breach last year led to the theft of personal data from 9.7 million current and former customers of Medibank and ahm, the group has been facing lawsuits from Quinn Emanuel Urquhart & Sullivan, Baker McKenzie, and a joint complaint from Maurice Blackburn Lawyers, Bannister Law Class Actions and Centennial Lawyers.

As of today Medibank has yet another front in the legal battle that has erupted since its 2022 privacy disaster, with Phi Finney McDonald commencing a shareholder class action in the Supreme Court of Victoria against the company.

Both the joint complaint and the Baker McKenzie class action are on behalf of former and current Medibank customers, but Phi Finney McDonald's lawsuit is more like the Quinn Emanuel Urquhart & Sullivan proceedings as the law firm is representing shareholders affected by the share price collapse of 18 per cent that followed the breach.

Phi Finney McDonald’s class action alleges that Medibank engaged in misleading and deceptive conduct and breached its continuous disclosure obligations in relation to the adequacy of its privacy and information security protections.

The class action seeks compensation for shareholders that suffered losses as a result of Medibank’s alleged disclosure failures. It is separate to the privacy litigation brought by Medibank customers whose personal and health information was breached.

Cameron Myers, principal lawyer at Phi Finney McDonald, said that following a preliminary investigation the firm considers there are grounds for legal action against the health insurer.

"Medibank’s customers and shareholders quite rightly expected the company, as one of Australia’s largest private health insurers, to take adequate steps to protect the incredibly sensitive information that it held," Myers said.

"Indeed, Medibank fostered this belief by informing the market that it had appropriate protections in place."

He said the market was clearly concerned about the distress and related impact on customers whose data had been accessed, and what that meant for company costs and revenue.

"Based on our preliminary investigations, we believe that Medibank shareholders are entitled to be compensated for losses suffered from the erosion of trust and confidence in Medibank once the true state of affairs was acutely exposed."

The news followed Medibank's announcement today it would return a further $125 million to Medibank and ahm customers as part of a COVID-related support package and give back program that will now reach $1.15 billion.

Medibank and ahm customers will receive funds through a “cash back”, which will be deposited into their bank account. It will range up to $91 for extras only policies and up to $402 for hospital and extras policies. On average this will be $19 for extras only policies and around $78 for hospital and extras policies.

"This year alone we have returned $408 million to customers through cash backs, premium increase deferrals and rolling over extras limits," Medibank group executive Milosh Milisavljevic said.

"At a time when people are really feeling the pinch of cost-of-living pressures, we know this extra cash in their pocket will be welcomed.

"We made a commitment at the start of the pandemic that we would not profit from COVID-19, and we’ve stuck by that promise."

Resident Medibank and ahm customers holding an active hospital and/or extras policy at any time during the period between 1 January 2023 and 30 June 2023 will be eligible for the cash back, which the company claims will be paid automatically by October this year.

A proportional cash back will be applied to customers who joined or whose policies have lapsed since 1 January 2023. This cash give back is being funded from additional COVID-19 permanent net claims savings and will not impact Medibank’s operating earnings for the six months ending 30 June 2023.

Medibank continues to monitor claims activity following COVID-19 restrictions easing in 2022 and plans to return any permanent net claims savings due to COVID-19 as part of its commitment to not profit from the pandemic.