{{Short description|Australian insurance company}} {{About|the Australian private health insurer|the Australian government-funded health insurance scheme|Medicare (Australia)}} {{Use dmy dates|date=November 2022}} {{Use Australian English|date=November 2022}} {{Infobox company | name = Medibank Private Limited | logo = Medibank logo 2013.svg | trading_name = Medibank | former_name = Health Insurance Commission | type = Public | traded_as = {{ASX|MPL}} | foundation = {{Start date and age|df=y|1975}} (Health Insurance Commission) | location = Melbourne, Victoria | hq_location_country = Australia | key_people = David Koczkar (CEO) | industry = Insurance | products = {{Plainlist| * Private health insurance * Travel insurance * Life insurance * Pet insurance }} | revenue = {{Increase}} {{AUD|8.18 billion}}<ref name="AR2024">{{Cite report |title=Annual Report 2024 |url=https://www.medibank.com.au/content/dam/retail/about-assets/pdfs/investor-centre/annual-reports/Medibank_Annual_Report_2024.pdf |access-date=14 November 2024 |publisher= Medibank Private Limited }}</ref> | revenue_year = 2024 | net_income = {{Increase}} {{AUD|570.40 million}}<ref name="AR2024" /> | net_income_year = 2024 | assets = {{Increase}} {{AUD|4.69 billion}}<ref name="AR2024" /> | assets_year = 2024 | equity = {{Increase}} {{AUD|2.31 billion}}<ref name="AR2024" /> | equity_year = 2024 | num_employees = 3,568<ref name="AR2024" /> | num_employees_year = 2024 | subsid = ahm | homepage = {{URL|medibank.com.au}} }}
'''Medibank''' is an Australian private health insurance provider headquartered in Melbourne, Victoria. It is Australia's largest private health insurance provider, covering around 4.2 million customers in 2024.<ref>{{Cite web|title=Company overview|url=https://www.medibank.com.au/about/company/overview/|access-date=10 May 2021|website=Medibank}}</ref> Medibank initially started as an Australian Government not-for-profit insurer in 1976, before becoming for-profit in 2009 under the Rudd Government and privatised by the Abbott government in 2014. Medibank now operates as a publicly listed company on the Australian Securities Exchange.<ref>{{Cite web|title=History|url=https://www.medibank.com.au/about/company/overview/history/|access-date=10 May 2021|website=Medibank}}</ref>
== History == Medibank began as an Australian Government private health insurance scheme, established by the Whitlam government in 1975 through the Health Insurance Commission.<ref name=":0">{{cite web |last=Biggs |first=Amanda |date=29 October 2004 |title=Medicare - Background Brief |url=https://parlinfo.aph.gov.au/parlInfo/search/display/display.w3p;query=Id%3A%22library%2Fprspub%2F8823863%22 |access-date=1 August 2014 |work=Past E-briefs |publisher=Australian Parliamentary Library}}</ref> In its original form, it was a universal health insurance programme funded through taxation, that also ensured free treatment at public hospitals and provided subsidies to private hospitals. The subsequent Fraser government reduced the subsidies and allowed the Health Insurance Commission (later Medibank Private) to enter the private health insurance market. Its purpose was to provide competition to private "for-profit" health funds and to put pressure on other health funds to keep premiums at a reasonable level.<ref>{{cite news |date=16 February 2010 |title=Opposition plans to sell Medibank Private |url=https://www.abc.net.au/news/2010-02-16/coalition-plans-to-sell-medibank-private/333200 |access-date= |newspaper=ABC News}}</ref><ref name="hazard">{{cite news |last=Reece |first=Nicholas |date=16 February 2013 |title=Hanging on to Medibank is a national health hazard |url=http://www.smh.com.au/opinion/politics/hanging-on-to-medibank-is-a-national-health-hazard-20130215-2eim2.html |access-date=29 June 2013 |newspaper=Sydney Morning Herald}}</ref> The original Medibank scheme became Medicare under the Hawke government, with Medibank Private continuing and now referred to as just Medibank.
In 2006, the Howard Coalition government announced that Medibank would be sold in a public float if it won the 2007 election.<ref name=MedibankSale>[http://www.aph.gov.au/Library/pubs/RB/2006-07/07rb02.pdf Dept. of Parliamentary Services 2006 research brief into the proposed sale of Medibank Private] {{webarchive|url=https://web.archive.org/web/20060928050229/http://www.aph.gov.au/library/pubs/rb/2006-07/07rb02.pdf |date=28 September 2006 }}</ref><ref>[http://www.medibank.com.au/About-Us/Corporate-Information.aspx Medibank Private: Corporate Information]</ref><ref name="efo">{{Cite news |url=http://www.heraldsun.com.au/archive/news/election-fight-over-2b-medibank-plan/story-e6frf7l6-1111112202312 |title=Election fight over $2b Medibank plan |author=Packham, Ben |access-date=29 June 2013 |date=13 September 2006 |newspaper=Herald Sun |publisher=News Limited }}</ref> However, they were defeated by the Australian Labor Party under Kevin Rudd, which had already pledged that Medibank would remain in government ownership. After 2009, although continuing in government ownership, Medibank operated as a government business enterprise, operating as a fully commercialised business, paying tax and dividends under the same regulatory regime as do other registered private health funds. Before the 2010 election, Liberal leader Tony Abbott made the same pledge to privatise Medibank if it won government, but the party was again defeated by Labor. Again, privatisation was Liberal party policy at the 2013 election, which the Coalition won.{{cn|date=November 2023}}
In March 2010, Medibank withdrew benefits for restricted services on its basic First Choice Savers hospital policy. As of June 2010, benefits for procedures such as heart operations and assisted reproductive services will be available only to customers on more comprehensive policies, costing as much as 50% more.<ref>{{cite news|url=http://www.theage.com.au/national/medibank-slashes-benefits-20100324-qwr6.html|title=Medibank slashes benefits|last=Metherell|first=Mark|date=25 March 2010|publisher=The Age|access-date=30 March 2010}}</ref> Medibank stated that the changes were intended to improve customer understanding of their products. They further stated the impact on customers will be small due to the low rate of use of the restricted services.<ref>[http://www.medibank.com.au/About-Us/Media-Centre-Details.aspx?news=409 Medibank Press Release - ''Medibank simplifying hospital products'', 25 March 2010]</ref>
In late March 2016, after 14 years as CEO, George Savvides retired earlier than expected.<ref>{{cite news|last=Binsted |first=Tim|title=Medibank CEO George Savvides to retire - and far earlier than expected |url=https://www.afr.com/markets/equity-markets/medibank-ceo-george-savvides-to-retire--and-far-earlier-than-expected-20151021-gkebg1 |access-date=1 April 2025 |work=Australian Financial Review |date=2015-10-21}}</ref> Former NAB chief financial officer Craig Drummond was offered the role and commenced in July 2016. Following Craig Drummond’s retirement, David Koczkar was appointed CEO in May 2021.<ref>{{cite news |last1=LaFrenz |first1=Carrie |title=Medibank confirms David Koczkar as new CEO |url=https://www.afr.com/companies/healthcare-and-fitness/medibank-confirms-david-koczkar-as-new-ceo-20210419-p57kci |access-date=1 April 2025 |work=Australian Financial Review |date=2021-04-19}}</ref>
==="Not for profit" to "for profit" health fund=== Medibank was previously run as a not for profit organisation and later operated as a for-profit government business enterprise with dividends paid to the Federal Government.<ref>{{cite web|url=http://www.finance.gov.au/property/gbe/index.html|title=Governance framework and principles for operating government owned business enterprises}}</ref> In May 2009, the Rudd government announced that Medibank would become a "for profit" business and would pay tax on its earnings. The process of converting the status of the business was completed on 1 October 2009 following approval from the then regulator, the Private Health Insurance Administration Council (PHIAC),<ref name="Lindsay Tanner Press Release" /><ref>{{cite web|url=http://www.phiac.gov.au/media-releases/phiac-approves-conversion-of-medibank-private-to-for-profit|title=PHIAC Press Release: PHIAC approval for conversion to a 'for profit' insurer|access-date=29 March 2010|archive-url=https://web.archive.org/web/20091030004704/http://www.phiac.gov.au/media-releases/phiac-approves-conversion-of-medibank-private-to-for-profit/|archive-date=30 October 2009|url-status=dead}}</ref> an independent statutory authority which regulated the Australian private health insurance industry until 2014. Private health insurance policy is now developed by the Department of Health.
=== Medibank privatisation === [[File:Medibank office in Westfield Woden July 2022.jpg|thumb|A Medibank office in Westfield Woden during 2022]] On 26 March 2014, Abbott government Minister for Finance Mathias Cormann announced that Medibank would be sold through an initial public offering (IPO) in the 2014{{Ndash}}2015 financial year.<ref>{{cite news|title=Medibank Private: Government announces sale through IPO, subject to market conditions|url=http://www.abc.net.au/news/2014-03-26/government-announces-sale-of-medibank-private/5347136|access-date=26 March 2014|newspaper=ABC News|date=26 March 2014}}</ref>
With the Medibank Private IPO priced at $2.15, the government exceeded the indicative range of $1.55 to $2.00 disclosed in the prospectus. However, it ensured that retail investors only pay $2.00, locking in a minimum 7% gain for them in the short-term.<ref>{{cite news|last=Mills|first=Jonathan|title=Medibank Private IPO: a model for future privatisations|url=https://www.intelligentinvestor.com.au/2014/11/medibank-private-ipo-model-future-privatisations|access-date=14 March 2015|newspaper=Intelligent Investor (Company)|date=11 November 2014}}</ref> The sale raised $5.7 billion for the government.<ref>{{Cite web|url = http://www.smh.com.au/business/medibank-to-raise-57-billion-20141123-11s5zy.html|title = Medibank to raise $5.7 billion| date=23 November 2014 }}</ref> The sale was completed with 100% of the company sold, listing on the Australian Stock Exchange under the code MPL on 25 November 2014, with 440,000 individual owners with a market capitalisation of A$5.921 billion.<ref>{{cite web |url=http://www.financeminister.gov.au/media/2014/1123-medibank-private-share-offer.html |title=Media Release 123/14 - Medibank Private Share Offer raises $5.679 billion |access-date=2014-12-01 |url-status=dead |archive-url=https://web.archive.org/web/20141125191902/http://www.financeminister.gov.au/media/2014/1123-medibank-private-share-offer.html |archive-date=25 November 2014 |df=dmy-all }}</ref><ref>{{cite web |url=http://www.financeminister.gov.au/media/2014/1125-medibank-private-joins-asx.html |title=Media Release 124/14 - Medibank Private joins the ASX |access-date=2014-12-01 |url-status=dead |archive-url=https://web.archive.org/web/20150310143634/http://www.financeminister.gov.au/media/2014/1125-medibank-private-joins-asx.html |archive-date=10 March 2015 |df=dmy-all }}</ref> Medibank held a 29% share of the private health insurance market.{{cn|date=November 2023}}
=== 2022 cyberattack === An attack gained access to Medibanks records using stolen credentials associated with a third-party contractor (remote access to Medibank's GlobalProtect VPN did not require multi-factor authentication (MFA) during the relevant period).<ref name="OAIC_concise_2024">{{cite web |date=19 June 2024 |title=Australian Information Commissioner v Medibank Private Limited – Concise Statement |url=https://www.oaic.gov.au/__data/assets/pdf_file/0025/221974/Australian-Information-Commissioner-v-Medibank-Private-Limited-concise-statement.pdf |access-date=14 February 2026 |publisher=Office of the Australian Information Commissioner}}</ref> Approximately 520 GB of data was exfiltrated between late August and 13 October 2022, including personal and health information later published on the dark web in November–December 2022.<ref name="OAIC_concise_2024" />
On 12 October 2022, Medibank CEO David Koczkar reported it had detected "unusual activity consistent with the precursors to a ransomware event" in their network but initially provided reassurance that no sensitive customer data has been accessed.<ref name="guardian">{{cite web | url = https://www.theguardian.com/australia-news/2022/oct/20/medibank-says-sample-of-stolen-customer-data-includes-details-of-medical-procedures| title = Medibank says sample of stolen customer data includes details of medical procedures |work = The Guardian | last = Butler | first = Josh | date = 20 October 2022 | access-date = 23 October 2022}}</ref><ref name="abc">{{cite web | title = Health insurer Medibank Private hit by cyber attack | url = https://www.abc.net.au/news/2022-10-13/health-insurer-medibank-hit-by-cyber-attack/101531392 | access-date = 23 October 2022 | date = 13 October 2022| publisher = ABC News}}</ref><ref name="9news">{{cite web | url = https://www.9news.com.au/national/medibank-cyber-incident-ahm-international-student-policy-offline-investigation/ae575907-ef76-4d64-b9f1-5666f4510aa5 | title = Health insurance provider Medibank hit by 'cyber incident' | last = Meacham | first = Savannah | date = 13 October 2022 | access-date = 23 October 2022 | publisher = 9News}}</ref> In response to the attack, Medibank took their AHM and international student policy management systems offline and requested a trading halt on the ASX.<ref name="abc" /><ref name="9news" /> Medibank later announced that a group of alleged hackers have made contact with the company to "negotiate", claiming to have stolen 200 gigabytes of customer data, while providing a sample of 100 customer policies including: "names, addresses, dates of birth, Medicare numbers, phone numbers, and medical claims data including information about diagnosis, procedures and location of medical services". Other information such as credit card security data have also been claimed to have been stolen, yet this remains unverified.<ref name="guardian" /><ref name="7news"> {{cite web | title = Fears mount as it emerges Medibank hack included personal medical data |url = https://7news.com.au/news/cyber-security/fears-mount-as-it-emerges-medibank-hack-included-personal-medical-data-c-8612032 |last1 = Delaney | first1 = Ailish |last2 = Taylor |first2 = Hayley |publisher = 7News | date = 22 October 2022 | access-date = 23 October 2022}}</ref>
On 23 October, Medibank announced that it had received a further 1,000 records from the hacker that contained policy records from the Medibank, ahm and international student databases, with Koczkar stating that they are "operating under the assumption that there is a potential that all customers could be impacted". This widened the previous assumption that only ahm and international student customers were affected, with the potential that all 3.9 million customer records were exposed.<ref name="guardian2">{{cite web | url = https://www.theguardian.com/australia-news/2022/oct/25/medibank-reveals-hack-has-affected-more-customers-than-first-thought| title =Medibank reveals hack could affect all of its 3.9 million customers |work = The Guardian | last = Taylor | first = Josh | date = 25 October 2022 | access-date = 26 October 2022}}</ref>
In November 2022, the hacker group, allegedly linked with Russian ransomware group REvil, released Medibank customer data on a dark web blog, after the company reportedly refused to pay the US$9.7m ransom,<ref name="abc2">{{cite news| url = https://www.abc.net.au/news/2022-11-10/medibank-data-breach-latest-dark-web-leak/101632746 | title = Hackers have released stolen Medibank data on the dark web. What does this mean for customers? | last = Morris-Grant | first = Brianna | newspaper = ABC News | date = 10 November 2022 | access-date = 27 November 2022}}</ref><ref name = "guardian3">{{cite web | title = Medibank hacker blog mysteriously disappears but experts warn it may return |url = https://www.theguardian.com/australia-news/2022/nov/23/medibank-hacker-blog-mysteriously-disappears-but-experts-warn-it-may-return |last = Taylor | first = Josh |website = TheGuardian.com | date = 23 November 2022 | access-date = 27 November 2022}}</ref><ref name = "guardian4">{{cite web | title = Medibank hacker says ransom demand was US$10m as purported abortion health records posted |url = https://www.theguardian.com/australia-news/2022/nov/10/medibank-hacker-says-ransom-demand-was-us10m-as-purported-abortion-health-records-posted |last = Taylor | first = Josh |website = TheGuardian.com | date = 10 November 2022 | access-date = 27 November 2022}}</ref><ref name = "afr">{{cite web | title = Authorities brace for Medibank data to be trickled out over weeks |url = https://www.afr.com/technology/alleged-medibank-hackers-demanded-us10m-ransom-20221110-p5bx0q |last1 = de Kretser|first1 = Ayesha |last3 = Mason|first3 = Max|last2 = Davidson|first2 = John|last4 = Tillett|first4 = Andrew | date = 10 November 2022 | access-date = 27 November 2022}}</ref> with reports by 1 December suggesting that the hacker group has released all compromised files remaining in their possession.<ref name="abc3">{{cite news|url = https://www.abc.net.au/news/2022-12-01/medibank-data-leak-has-everything-been-released-now/101720028 | title = More Medibank customer data released onto dark web. Has everything now been released?| last1 = Janda | first1 = Michael | last2=Ziffer| first2 = Daniel | newspaper = ABC News| date = 1 Dec 2022 | access-date = 18 December 2022}}</ref>
Following an investigation, the Office of the Australian Information Commissioner alleged that Medibank had failed to take reasonable steps to protect the personal information it held, and that the alleged failure constituted a serious and/or repeated interference with privacy affecting approximately 9.7 million individuals.<ref name="OAIC_concise_2024" />
== Acquisitions and mergers == In January 2009, Medibank acquired the Wollongong-based insurer ahm (Australian Health Management) and merged with the HSA Group in April 2009.<ref name="Lindsay Tanner Press Release">[http://www.financeminister.gov.au/media/2009/mr_632009.html Lindsay Tanner Press Release] {{webarchive|url=https://web.archive.org/web/20091002091824/http://www.financeminister.gov.au/media/2009/mr_632009.html |date=2 October 2009 }}</ref> Following these transactions, Medibank created the Health Solutions Division, which is focused on delivering occupational health services (such as employment medical examinations and injury treatment) and health coaching programs to help Australians manage health conditions (e.g. diabetes). Services are delivered under the Medibank Health Solutions brands.<ref>{{cite web|url=http://www.medibankhealth.com.au/About.asp|title=Medibank Health Solutions "about us"}}</ref>
In July 2010, Medibank acquired health services provider, McKesson Asia-Pacific, absorbing it into Medibank Health Solutions.<ref>{{cite web|title=McKesson to Sell Its McKesson Asia-Pacific Business to Medibank Private Ltd.|url=http://www.mckesson.com/about-mckesson/newsroom/press-releases/2010/mckesson-to-sell-its-mckesson-asia-pacific-business-to-medibank-private-ltd/|access-date=March 30, 2016|archive-url=https://web.archive.org/web/20160413215713/http://www.mckesson.com/about-mckesson/newsroom/press-releases/2010/mckesson-to-sell-its-mckesson-asia-pacific-business-to-medibank-private-ltd/|archive-date=April 13, 2016|url-status=dead}}</ref><ref>{{cite news |title=Medibank acquires McKesson Asia-Pacific |url=https://www.smh.com.au/business/medibank-acquires-mckesson-asiapacific-20100409-rwsd.html |access-date=1 April 2025 |work=Sydney Morning Herald |date=2010-04-10}}</ref> The telephone and online health management programs services provided by McKesson Asia-Pacific, including "healthdirect Australia", "Nurse-on-Call", and "Healthline", will be maintained by Medibank.
==Industry structure and main competitors== {{main|Healthcare in Australia}}
Private health insurance in Australia is heavily regulated to protect consumers. Prudential supervision is undertaken by the Australian Prudential Regulation Authority (APRA) to ensure health funds remain solvent.<ref>{{cite web|url=http://www.phiac.gov.au|title=PHIAC|access-date=29 March 2010|archive-url=https://web.archive.org/web/20100318030033/http://www.phiac.gov.au/|archive-date=18 March 2010|url-status=dead}}</ref> APRA also publishes extensive statistics on the industry and annual financial statement for individual health funds to provide full transparency for stakeholders. The pricing and features of health insurance products is regulated by the Department of Health.<ref>{{cite web|url=http://www.health.gov.au/internet/main/publishing.nsf/Content/portal-Health%20insurance|title=Department of Health}}</ref>
To inform consumers, the Private Health Insurance Ombudsman operates a website to explain private health insurance and provide a standardised basis to compare health fund products.<ref>{{cite web|url=http://www.privatehealth.gov.au/|title=PHIO}}</ref>
==References== {{Reflist|2}}
{{S&P/ASX 50}} {{S&P/ASX 200}} {{Authority control}}
Category:Former Commonwealth Government-owned companies of Australia Category:Medical and health organisations based in Australia Category:Financial services companies established in 1975 Category:Companies based in Melbourne Category:1975 establishments in Australia Category:Health insurance in Australia Category:Health care companies established in 1975 Category:Insurance companies of Australia