‘We have listened’: Medibank axes exec bonuses, freezes CEO pay, following cyber attack

Despite a jump in profit, CEO David Koczkar won’t get a pay rise and other Medibank executives will be denied bonuses after 9 million customers were hacked.

Medibank CEO David Koczkar says ‘while it has been a very challenging year’ it has learnt many lessons. Picture: NCA NewsWire / Nicki Connolly

Australia’s biggest health insurer Medibank has axed bonuses for its executive leadership team as a consequence of last year’s cyber attack that involved Russian hackers stealing and publishing sensitive health information of more than 9 million customers.

Chief executive David Koczkar also will receive no pay rise, with his base pay remaining at $1.55m, despite the company’s annual profit vaulting 29.8 per cent to $511.1m and signing record policyholders.

Medibank junked short-term bonuses payments for Mr Koczkar, chief financial officer Mark Rogers, chief customer officer Milosh Milisavljevic and Andrew Wilson, who is the boss of its health services division a direct result of the cyber attack.

“The cyber crime was a serious event and had a serious impact to our customers, our people and our business, so there needs to be serious consequences,” Mr Koczkar said.

“The board has used their discretion and it’s a meaningful response.”

Chairman Mike Wilkins warned at the company’s annual meeting last November that there would be consequences following the cyber attack, which involved Russian hackers publishing sensitive health information — including pregnancy terminations and treatment for mental health and alcohol abuse — on the dark web.

“The board is very well aware of the need to make sure that there is an alignment between remuneration and outcomes on all matters,” Mr Wilkins said at the time.

Mr Koczkar received a deferred equity award worth $660,095 which vested this year, but that related to Medibank’s performance before the cyber attack.

It follows the company attracting criticism last year when executives were paid more than $7.3m in bonuses — but those payments were issued for the previous financial year before the cyber attack.

Mr Koczkar said the company had “listened and learnt” and was working on rebuilding trust.

“There were some customers that left us but the vast majority stayed and we‘ve been able to work really hard to regain the trust of the community and we’re growing again. But we know that the job’s not over.”

Mr Koczkar said the company surpassed four million customers for the first time in its 47-year history. Net policyholders grew by almost 11,000 or 0.6 per cent. But it had the biggest jump in non-resident policyholders, which surged 40 per cent, lifting total growth to almost 275,000.

The company’s clean up bill from the cyber attack totalled $46.4m last year and expected to be $30m to $35m in the year ahead.

“These criminals are determined and determined to get money. They are criminals and they work to try and find vulnerabilities in every company around every company, government and other institutions around the world. This is an ever present threat,” Mr Koczkar said.

“We have to continue to evolve and invest like every company does. We have to be ready. Before the cyber event we were getting around 10 million perimeter attacks a day. That went up to 80 million perimeter attacks today during the cyber events and is now back down to 15 million. That is a significant amount of potential incursion there.”

Medibank CEO David Koczkar. Picture: NCA NewsWire / Nicki Connolly

Overall revenue firmed 3.2 per cent to $7.36bn. Health insurance premium jumped 4.2 per cent to $7.15bn, while gross claims paid increased 3.4 per cent to $5.9bn.

Mr Koczkar said the company had reversed a pre-pandemic trend of Australians (mainly the young and healthy) withdrawing from private insurance, with more people taking out policies amid spiralling wait lists — “six to eight years long” in some states — across the public system.

“However, it is a challenging environment for many households and people are responding in different ways. While consumers are paring back their spending in a number of areas such as petrol, household goods and apparel, health is not one of those (areas of spending cuts).

“Spending on health is growing as people continue to make their health and wellbeing a priority.”

Medibank has forecast underlying claims per policy unit growth of 2.6 per cent in the year ahead. This compares with Nib chief executive Mark Fitzgibbon flagging 4-5 per cent growth on Monday, saying the days of sub-3 per cent premium rises are over as inflation sweeps across the healthcare sector.

Medibank is also targeting $20m in productivity savings across the next two years.

Macquarie analysts said Medibank delivered a strong result, with net margin of 9.1 per cent beating consensus estimates of 8.8 per cent.

It shares leapt 2.6 per cent on Wednesday to $3.51, giving it a market value of $9.6bn.

Hugh Giddy, head of research at IML, which is an investor in Medibank, said he wanted management to paid short-term incentive (STI) bonuses because it meant they were delivering for the company, so long as they “balanced and appropriate”.

“It’s the job of the board to make shore STIs are appropriate to incentivise shareholder friendly actions and if the STIs are paid that should mean the shareholders have done well,” Mr Giddy said.

Medibank will pay a final dividend of 8.3c, fully franked, a share on October 5. This takes the group’s total investor payout for the year to 14.6c a share — a 9 per cent increase on 2022, reflecting a payout ratio of 80.5 per cent of underlying net profit.

Originally published as ‘We have listened’: Medibank axes exec bonuses, freezes CEO pay, following cyber attack