Deloitte to examine incident, control effectiveness and the response of Medibank. The Australian Prudential Regulation Authority (APRA) has flouted tighter cyber security controls for regulated industries following the Medibank breach. The regulatory authority has intensified its supervision of Medibank in the wake of the recent hack, which saw 9.7 million customers' details impacted. APRA’s review, to be conducted by Deloitte, will examine the incident itself, control effectiveness and the response of Medibank. Following the results of the review, APRA plans to consider whether further regulatory action is needed, especially regarding the strength of its operational risk controls. "While APRA notes Medibank's constructive response to date, APRA will consider whether further regulatory action is needed when findings of the report become clear," APRA member Suzanne Smith said. "APRA expects Medibank to undertake any recommended remediation actions and ensure there is appropriate consequence management, including impacts to executive remuneration where appropriate." In addition, APRA will intensify its supervision of all entities not meeting the Information Security Prudential Standard CPS 234 as a result of the extensive independent review underway, and other supervisory activities. Medibank confirmed it has no cyber insurance following a breach that has seen cyber criminals access all of its customers’ personal data. The lack of cyber insurance means that the incident could cost between $25 to $35 million, excluding costs accrued in remediation or legal fees. "Recent cyber-attacks reinforce the need for ongoing vigilance and focus by boards on operational resilience," Smith said. "They are a stark reminder for boards to ensure they can answer these fundamental questions: Do you know what data you are holding? Do you know where it is? How do you know it is safe? And do you need to retain it? "Cyber security is a highly significant risk area for all regulated entities and we remind banks, insurers and superannuation funds to remain vigilant in order to protect their beneficiaries and the Australian community." Earlier this month, the Australian Federal Police (AFP) claimed the attack was carried out by "a group of loosely affiliated cyber criminals" based in Russia. Related content news Exclusive Networks acquires Nextgen Group Walters will remain as Nextgen Group A/NZ CEO along with key leadership members. By Julia Talevski 28 Mar 2024 6 mins Mergers and Acquisitions Vendors and Providers Emerging Technology news blueAPACHE makes multi-million-dollar investment with ServiceNow platform The decision to leverage the ServiceNow platform enhances its operational capabilities and aligns with bluePACHE’s growth ambitions and strategic goals. By Julia Talevski 28 Mar 2024 4 mins Managed Service Providers Software Development Enterprise Applications news Tecala appoints Ethan Group’s Adrian Ng as professional services head Will be focused on delivering transformation programs for customers. By Eleanor Dickinson 28 Mar 2024 2 mins Managed Service Providers Digital Transformation news KPMG Australia joins SAP PartnerEdge program Follows KPMG’s acquisition of SAP partner Think180 last year. By Eleanor Dickinson 28 Mar 2024 2 mins Enterprise Applications IT Management Software Development SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe