The Australian Prudential Regulation Authority (APRA) has flouted tighter cyber security controls for regulated industries following the Medibank breach.
The regulatory authority has intensified its supervision of Medibank in the wake of the recent hack, which saw 9.7 million customers’ details impacted.
APRA's review, to be conducted by Deloitte, will examine the incident itself, control effectiveness and the response of Medibank.
Following the results of the review, APRA plans to consider whether further regulatory action is needed, especially regarding the strength of its operational risk controls.
“While APRA notes Medibank’s constructive response to date, APRA will consider whether further regulatory action is needed when findings of the report become clear,” APRA member Suzanne Smith said.
“APRA expects Medibank to undertake any recommended remediation actions and ensure there is appropriate consequence management, including impacts to executive remuneration where appropriate.”
In addition, APRA will intensify its supervision of all entities not meeting the Information Security Prudential Standard CPS 234 as a result of the extensive independent review underway, and other supervisory activities.
Medibank confirmed it has no cyber insurance following a breach that has seen cyber criminals access all of its customers' personal data.
The lack of cyber insurance means that the incident could cost between $25 to $35 million, excluding costs accrued in remediation or legal fees.
“Recent cyber-attacks reinforce the need for ongoing vigilance and focus by boards on operational resilience,” Smith said. “They are a stark reminder for boards to ensure they can answer these fundamental questions: Do you know what data you are holding? Do you know where it is? How do you know it is safe? And do you need to retain it?
“Cyber security is a highly significant risk area for all regulated entities and we remind banks, insurers and superannuation funds to remain vigilant in order to protect their beneficiaries and the Australian community.”
Earlier this month, the Australian Federal Police (AFP) claimed the attack was carried out by “a group of loosely affiliated cyber criminals” based in Russia.