Medibank Private Limited (MPL) Earnings Call Transcript & Summary

Good morning all, and thank you for joining us at such short notice. I'll begin by acknowledging the traditional owners and custodians of country throughout Australia and their connections to land, sea and community. I join you today from Naarm, the home of the Wurundjeri Woiwurrung Peoples. I pay my respects to their elders past, present and emerging, and I extend my respect to all elders of the lands on which we work and live. I'm joined today by Medibank's executive team, including our Group Executive of Technology and Operations, John Goodall and our Group Executive CFO and Group Strategy, Mark Rogers. As you know, on Friday, we entered a voluntary trading suspension as we continued to investigate the impact and implications of the cybercrime announced on 13 October. This morning, we provided an update to our investigation, and I will take a few moments to run through what we've now learned through our investigation and what we are doing in response, before Mark provides an update of how this will impact our FY '23 outlook. Since yesterday's announcement, our investigation has now established the criminal had access to all ahm customers' personal data and significant amounts of health claims data, all international student customers' personal data and significant amounts of health claims data, all Medibank customers' personal data and significant amounts of health claims data. As previously advised, we have evidence that the criminal has removed some of our customers personal and health claims data, and it is now likely that the criminal has stolen further personal and health claims data. As a result, we expect that the number of affected customers could grow substantially. Again, I apologize unreservedly to our customers. This is a terrible crime. This is a crime designed to cause maximum harm to the most vulnerable members of our community. Our priority is to continue working to understand the specific data that has been taken for each of our customers so that we can contact them directly to let them know. Yesterday, we announced a comprehensive customer support package for affected customers. Given that the stress this crime is causing our customers, we will also defer premium increases for Medibank and ahm customers until 16 January 2023. The investigation into the cybercrime event is continuing, with particular focus on identifying which systems and networks were accessed and what data was removed by the criminal. The cybercrime event is subject to a criminal investigation by the Australian Federal Police. Medibank continues to work with specialized cybersecurity firms, the Australian Cyber Security Centre and government stakeholders. I'll now pass to Mark to provide you a business operations update and a first quarter trading performance update and changes to our FY '23 outlook, Mark?

Thanks, David. Normal business operations have been maintained with customers continuing to access health services. Given the uncertainty around this cybercrime incident, we're providing a trading update for the first quarter of FY '23 and updating our FY '23 outlook. Net resident policyholder growth for the first quarter was 14,600. On a rolling 12-month basis, this equates to growth of 3.2%, which is above the previously announced FY '23 outlook of approximately 2.7%. Given the uncertain impact of the cyber event, today, we've withdrawn our FY '23 outlook for policyholder growth and we'll provide a further update at the half year '23 results. Underlying net claims expense per resident policy unit continues to track below the FY '23 outlook of 2.3%. This has resulted in further permanent net claim savings due to COVID of approximately $62 million, and these savings will offset the cost of the deferral of premium increases for Medibank and ahm customers to 16 January 2023. PHI management expense productivity initiatives remain in line with the FY '23 outlook and our expectation for inflation remains unchanged. Importantly, our business remains strongly capitalized. And at 30 September 2022, our health insurance capital ratio was 13.4% and unallocated capital was approximately $150 million. APRA has released the final private health insurance capital standards, which were effective from 1 July 2023. And we continue to expect the implementation of these standards will not negatively impact our capital position. Based on our current actions in response to the cybercrime event, noting that Medibank does not have cyber insurance, we currently estimate $25 million to $35 million of pre-tax nonrecurring costs will impact earnings in 1H '23. These nonrecurring costs do not include further potential customer and other remediation, regulatory or litigation-related costs. The cybercrime event continues to evolve. And at this stage, we are unable to predict with any certainty the impact of any future events on Medibank, including the quantum of any potential customer and other remediation, regulatory or litigation-related costs. We will provide further updates as appropriate, including at the AGM. And I'll now hand the call back to David.

Thanks, Mark. Now I'll just hand over the call for any questions you may have. Thank you.

[Operator Instructions] Your first question comes from Andrew Buncombe with Macquarie.

Maybe just a quick one for my clarification. I understand that you say in the release that your systems have not been encrypted by ransomware. Maybe if I can ask it a little bit differently, please. Has Medibank been asked to pay a ransom?

Thanks, Andrew, for the question. Given the sensitive nature of this event, I can't go into any detail. I won't comment on this. This is subject to a criminal investigation.

That's all right. And then my second question was just in relation to the $25 million to $35 million charge. Is that going to be removed from underlying NPAT? Or how should we think about that potentially impacting the dividend?

So Andrew, we haven't made a decision on how we actually report that number within the financials other than to say we'll be fully transparent on the cost at the half year results. It's too early also for us to actually determine how we'll strike the first half and the second half dividend. That will really depend on the underlying business momentum and the level of unallocated capital at the time.

Your next question comes from Matt Dunger with Bank of America.

Just if we can go back onto the $25 million to $35 million of cost. Can you talk to us about what that includes and what the composition of that cost is? And also you're saying [indiscernible] in the first half of '23. Do you expect to end all of the $25 million to $35 million in first half of '23 as well?

Thanks, Matt. So there are -- in broad terms, there are 3 buckets that comprise the $25 million to $35 million of costs. So firstly, there's a customer communication and customer service costs. So contacting our customers and providing support when they call into us. So obviously, there will be a significant additional load in our contact centers as a consequence of this event. The second cost bucket includes 2 components. Firstly, it's the experts we are [ boarding ] to support us thus far on this incident and those that will support us between now and the end of the first half as we look to recover from this incident, and that includes additional technology costs and investment as we look to strengthen our environment. And the third and most significant cost is actually to protect our customers' identities. And so we've made a significant provision in those numbers for ID monitoring and ID replacement costs. And that third bucket is the largest of the 3 buckets, Matt. In terms of whether it's a provision or actual cash cost, I'd expect the vast majority of those costs will actually be spent in the first half.

And if I could just ask a follow-up on how many customers you expect might take up the hardship that you've offered?

I won't give out specific numbers because there's a number of different packages, Matt, so it will get complicated. But in sizing that, there are a number of other recent examples and a number of service providers we work with that provide these services to customers in other incidents, and they have provided what the range of take-up rates have been historically. So we've relied on the service providers and their experience to guide us on each of the individual take-up rates. But of course, there will be -- every incident will be different. So there is some volatility in those numbers, and that's why we provided a range.

Your next question comes from Andrew Goodsall with MST Marquee.

Just in terms of the work that you're doing, I guess, on your systems at the moment, would that ultimately provide a longer-term or more permanent fix? Or is that a different level of expense that you might incur in the future?

I might just get -- thanks, Andrew. I might get John to talk about the systems, and then Mark to pick up the comment about how we're thinking about costs.

Yes, Andrew, it's John. I think definitely some of the tools we've deployed forensically right now will likely -- we'll retain, but some we won't. So I think part of the analysis we're doing and probably the longer-term planning is which we'll keep and which will let go. Mark?

Yes, then on the cost side -- Andrew, so let's be clear, we're not talking about changing our IT infrastructure, we're not talking about replacing customers or other software systems, what we're talking about is whether there's incremental investment on IT security. So I think it's important in that context. We're not talking about infrastructure or systems replacements.

All right. So I mean that -- I presume that's sort of something that rolls off the back of this, but there's not -- what you're saying it's not a major change or cost coming forward -- going forward?

Well, I think I'd just say that we have launched a full investigation into this event, and it's too early to really be definitive. And obviously, we'll share what we know when we know it.

Got it. And a quick one. Just -- and I guess this is probably a difficult question, but just your sense of containment, how they sort of comes to a close in a sense for you or just is it a long drag? Just anything you could -- color you could add on your thought -- your thinking around that. .

Well, I think the first aspect which has not changed since we spoke last Monday is the containment of the ransomware or encryption of our systems, and John can talk about that. Our priority now is to safeguard our customers and their data given we now know that data has been stolen. And this is a deliberate malicious attack on our customers and some of the most vulnerable members of our community. So we will continue to work with government, with our cybersecurity experts, with the AFP and ACSC as this unfolds. Maybe, John, you could address the point on the encryption and ransomware.

Yes. So I'll call out a couple of things. We've engaged the real best technology experts in the field, and that's people called CrowdStrike, Microsoft Threat Intelligence and the ACSC, and we're absolutely following their advice on how we manage and recover from this. And it's worth calling, CrowdStrike and Microsoft provide global services responding to these exact types of incidents. And they've been the guys who've deployed specialized forensic tools to assist with our investigation, to contain the threat, to strengthen our network and enable additional ongoing real-time monitoring. So we're absolutely following their advice.

Your next question comes from Elizabeth Miliatis with Jarden.

The first one is just a clarification on the wording in your release. There's a comment on the first page, where you've noted that data was initially taken but then the criminal had stolen further data. Just wanted to confirm whether the criminal continue to have access to any of your systems subsequent to your initial discovery of the attack? Or was it sort of a multi-day period once you had found them out? Or did you manage to sort of kick them out of your systems and contain that?

Yes. Thanks for the question, Elizabeth. So we -- our systems discovered unusual activity now 2 weeks ago. And our -- when we were able to update you all last Monday, we were -- we said that we had contained the ransomware threat, which is what John has gone into around encryption of systems and ability to support customers in our ongoing operations. At that time, we had no evidence that customer data had been removed from our business. It was only subsequent to that on the following Wednesday, so now 1 week ago, that the criminal contacted us and sent a sample file. Then over the last few days, we received subsequent sample files from the criminal. And that's why as we learn and understand those files and conduct our investigation, we provide further updates. I think I've committed -- and we've committed all throughout that as soon as things become clear to us, we'll make it clear to our stakeholders and these updates are a point in time.

Okay. Got it. And then just a second question, going back to the costs that you'll incur, the $25 million to $35 million. You noted that a portion of that within the IT spend will sort of likely continue as its extra monitoring that you've implemented. Are you able to quantify that number on a sort of longer-term basis?

It's still a little early to say how much that will be. But if I can just dimensionalize the cost bucket, that is one of the smaller cost buckets of technology spend, it's one of the smaller cost buckets. So even if all the costs we're expecting to incur in this period continued, that wouldn't be material in the context of our total management expenses.

Okay. Are you -- just one final question on those costs. Are you able to sort of break down the $25 million to $35 million broadly across those 3 buckets that you alluded to earlier?

Yes, the third bucket, which is the ID protection is the majority of the cost. And then the other 2 buckets, they're broadly equal across the balance of the 50%.

Your next question comes from Siddharth Parameswaran with JPMorgan.