Medibank cops strict operating conditions from insurance regulator over cyber attack

Medibank has been forced to undertake some strong regulatory requirements by the Australian Prudential and Regulation Authority (APRA) as a result of its "major cyber incident" back in October. The health insurer now has to keep at least $250m in capital on hand, "reflecting weaknesses identified in Medibank's information security environment" and will need to keep that level of capital "until an agreed remediation program of work is completed by Medibank to APRA’s satisfaction". APRA also "expects Medibank to ensure there is appropriate accountability and consequence management, including impacts to executive remuneration". Good, more of this kinda thing, particularly the consequences for executives.