Medibank

Executive Summary

Profile

Australia’s largest resident private health insurer by policy count; Medibank Private Limited is a publicly listed, for-profit company founded in 1976 and listed on the ASX in November 2014, operating across two segments — Health Insurance (under Medibank and ahm brands) and Medibank Health (via Amplar Health) — serving resident and non-resident policyholders, corporate clients, and government partners across Australia.

Scale & Footprint

• AUD 8,604.0 million revenue in FY25; market capitalisation approximately AUD 12.67–12.83 billion (early May 2026); more than 4.2 million total health insurance customers; 26.5% resident PHI market share as of 30 June 2025
• Approximately 3,600–3,650 full-time equivalent staff, including approximately 750 health professionals
• Operations: Melbourne, Australia; Service Coverage: Australian domestic market (resident and non-resident), with a primary care clinic network of 168 sites as of 31 December 2025

What You Should Know

• Sustained cybersecurity liability: The October 2022 breach affecting approximately 9.7 million individuals remains unresolved across multiple concurrent proceedings — OAIC civil penalties, two class actions, and an APRA capital overlay — generating approximately AUD 35–46 million in annual costs and open-ended regulatory exposure requiring close monitoring.
• Strategic pivot under active integration pressure: Rapid simultaneous acquisitions — Better Medical, Medinet, and Pinnacle Health Group — completed within a compressed timeframe introduce execution risk during a period of intensive APRA regulatory oversight.
• Gradual market share erosion: Resident PHI market share declined from 27.08% in FY23 to 26.5% in FY25, with management publicly acknowledging unsustainable competitive intensity as of February 2026.
• Underlying financial resilience: Despite cybercrime costs and a statutory profit decline in 1H26, underlying NPAT has grown consistently — reaching AUD 618.7 million in FY25 — supported by a conservative balance sheet and regulated premium cycles.

Ownership & Governance

• Fully public company with no controlling shareholder; institutional investors hold approximately 51.8% of shares, with AustralianSuper the largest single holder at approximately 10.0%, followed by State Street, BlackRock, and Vanguard
• Nine-member board comprising eight independent non-executive directors and the CEO (David Koczkar); five standing committees including a dedicated Cyber Response Board Committee; board refreshed at November 2025 AGM with two retirements and two new appointments

Business Environment

• Market leader within a concentrated Australian PHI market where five insurers hold over 82% of policies; ASX-listed with significant market capitalisation supporting institutional visibility and passive fund flows
• Underlying NPAT grew 8.5% in FY25; Medibank Health segment earnings grew 27.0% in FY25, with a stated AUD 200 million earnings target by FY2030; ahm brand growing at 4.9% versus 0.8% for the primary brand
• Active M&A execution: Better Medical (AUD 163.5 million, December 2025), Medinet (completed early 2025), Pinnacle Health Group (announced August 2024), and a three-year technology partnership with League announced October 2024
• OSHC revenue market share reached 39.4% in FY24, with Medibank the preferred provider for nearly half of Australian universities as of June 2025 — a high-growth, institutionally anchored niche

Key Strengths

• Dual-brand market scale and OSHC dominance: A 26.5% resident market share combined with 39.4% OSHC revenue share and preferred university partner status creates structural contracting leverage and institutionally embedded switching costs unavailable to smaller competitors.
• Vertically integrated health services platform: Amplar Health’s 168-clinic network, virtual health, in-home care, and corporate wellbeing capabilities delivered 4.3 million health interactions in FY25, generating 27.0% earnings growth and advancing a structurally differentiated insurer-to-health-company transition.
• Digital engagement flywheel: Live Better surpassed 1 million participants in 1H26; policyholder health service engagement rose from 46% in FY24 to 55% in 1H26, creating a behavioural data asset and retention advantage not replicable by competitors without comparable platforms.

Specific Risk

• Cybersecurity breach — multi-front unresolved exposure (Critical): OAIC civil penalty proceedings, Federal Court consumer class action, and Supreme Court of Victoria shareholder class action all remain ongoing as of May 2026; APRA’s AUD 250 million capital overlay persists; annual breach-related costs running at approximately AUD 35–46 million with approximately AUD 35 million expected in FY26; April 2025 privilege ruling under appeal risks further evidentiary disclosure.
• APRA capital adequacy overlay (High): The AUD 250 million additional capital requirement — approximately 21% of required capital as of 31 December 2025 — remains conditional on remediation completion, constraining M&A and dividend flexibility with no confirmed removal timeline.
• Competitive intensity and resident market share erosion (High): Market share declined from 27.08% (FY23) to 26.5% (FY25); statutory NPAT fell 11.0% in 1H26; management publicly characterised competitive dynamics as unsustainable as of February 2026.
• Concurrent acquisition integration risk (Moderate): Three health services acquisitions — Better Medical, Medinet, and Pinnacle — completed within approximately 12 months, each with distinct clinical governance and IT systems, introducing execution risk during peak APRA oversight.
• Chief Risk Officer acting appointment (Moderate): Anne-Marie Paterson assumed the CRO role in an acting capacity in February 2026, creating continuity uncertainty in regulatory engagement at the most intensive point of APRA remediation oversight.

—

1) Overview of the Company

Medibank Private Limited is an Australian publicly listed health company headquartered in Melbourne, Victoria, Australia. Founded on 1 October 1976 as a government-owned, not-for-profit private health insurer, the company transitioned to a for-profit model in 2009 and listed on the Australian Securities Exchange (ASX: MPL) via an IPO on 25 November 2014. The fiscal year ends on 30 June, and the company’s appointed auditor is PricewaterhouseCoopers (PwC).

The company’s stated purpose is “Better Health for Better Lives,” underpinned by a 2030 Vision to deliver the best health and wellbeing for Australia. Its strategic pillars encompass delivering leading customer experiences, differentiating its insurance business, expanding in health services, and strengthening its operational foundations.

Medibank operates through two primary segments. The Health Insurance segment underwrites and distributes private health insurance products under the Medibank and ahm brands, targeting families, corporates, young adults, and non-residents including international students, visitors, and workers. Products span government-standardized hospital tiers (Basic, Bronze, Silver, Gold), extras cover (including branded “Top Extras” tiers offering 60%, 75%, or 90% claim-back percentages), and specialized Overseas Health Cover. The Medibank Health segment coordinates and delivers health services — including telehealth, in-home care, primary care, and corporate wellbeing — primarily through the Amplar Health subsidiary network, and also distributes travel, life, pet, and income protection insurance. The Health Insurance segment remains the dominant earnings contributor, with Medibank Health contributing approximately 10% of earnings in FY25.

Branded customer-facing platforms include Live Better, a digital health and wellbeing rewards program; My Medibank, a digital account management application; and Members’ Choice, one of Australia’s larger private provider networks. Members’ Choice Advantage incorporates partnerships such as Specsavers for optical and audiology services.

As of 30 June 2025, Medibank served more than 4.2 million total health insurance customers — resident and non-resident — and employed approximately 3,600–3,650 full-time equivalent (FTE) staff, including approximately 750 health professionals. The company holds a 26.5% share of the Australian resident private health insurance market as of 30 June 2025, qualifying it as one of the market’s largest participants; detailed competitive context is addressed in the Market Position section. Group revenue from external customers reached AUD 8,604.0 million for the fiscal year ended 30 June 2025.

The Amplar Health subsidiary delivers health services across virtual, primary, community, and acute care settings. Key subsidiaries within Amplar Health include Home Support Services (HSS), which provides clinical homecare services such as chemotherapy and dialysis at home; Medinet Australia, focused on virtual health services (fully acquired in 2025); Pinnacle Health Group, offering corporate health and wellbeing services; and Better Medical, a primary care network of 61 clinics acquired on 16 December 2025. Medibank also holds a 90.1% investment in Myhealth Medical Group, a primary care clinic operator, following an increase from 49.0% effective 5 January 2024. The company aspires to achieve 10 million primary care consultations per year by FY2030.

Medibank is regulated by the Australian Prudential Regulation Authority (APRA) as a registered private health insurer and is supervised by the Office of the Australian Information Commissioner (OAIC). Effective 1 July 2023, APRA imposed an additional capital adequacy requirement of AUD 250 million on the company following a 2022 cybercrime event. The company holds Carbon Neutral certification under the Australian Government’s Climate Active program.

Rob Deeming, Group Lead – Digital & Ventures, departed the company in July 2025. Anne-Marie Paterson was appointed Group Lead – Chief Risk Officer (acting) in February 2026, following Tom Exton’s appointment to Group Lead – Chief Risk and Compliance Officer in July 2024.

2) History

Medibank Private was established on 1 October 1976 as the health insurance arm of the Health Insurance Commission, owned and operated by the Australian Government. The company was created to provide Australians with access to private health insurance at a time when the government sought to complement the public Medicare system with a state-backed private option.

In 1998, the company underwent its first structural transformation, separating from the Health Insurance Commission to become Medibank Private Limited — an independent Government Business Enterprise (GBE) with its own commercial Board of Directors and the Commonwealth as sole shareholder. The year 2000 brought active membership growth initiatives, including the Sales Intensity Program and distribution via internet and shopping center kiosks to capitalise on the government’s Lifetime Health Cover initiative. However, the company reported a loss of AUD 175 million for the 2001–02 financial year, prompting a significant restructuring: in June 2002, Medibank reduced management and specialist professional positions by approximately 118 roles, implemented a flatter corporate structure, and appointed George Savvides as acting Managing Director in April 2002. Simon Blair joined as Chief Operating Officer in June 2002. In June 2003, the Australian Government announced it would retain ownership of Medibank Private rather than proceed with a proposed privatisation.

The mid-2000s saw Medibank expand its product and service scope. In December 2008, ahm (Australian Health Management) members approved Medibank’s acquisition, with the merger implemented on 15 January 2009 — materially broadening Medibank’s insured membership base under a second brand. HSA Group formally merged with Medibank Private on 1 April 2009, establishing the Medibank Health Solutions division. Also in late 2008, Medibank Life Insurance and Medibank Pet Insurance were launched nationally, extending the product range beyond core health cover. On 1 October 2009, the company converted to a for-profit, tax-paying entity, representing a fundamental shift in its operating model and financial obligations.

The 2010s marked rapid diversification into health services delivery. In July 2010, Medibank completed the acquisition of McKesson Asia-Pacific to extend its health management capabilities, followed by the August 2010 acquisition of Carepoint Industrial Health Services in Western Australia. In November 2012, Medibank went live as the sole source operator of health services for the Australian Defence Force and its approximately 80,000 personnel. In April 2013, Medibank launched ‘Anywhere Healthcare’, a video-enabled virtual healthcare service — a differentiated digital capability ahead of broader industry adoption of telehealth. In July 2014, the Immigration Contract with the Commonwealth was not renewed, representing a contraction in government service revenues ahead of privatisation.

The IPO on 25 November 2014 was the most consequential structural event in the company’s history. The Commonwealth offered 100% of its shareholding — approximately 2,754 million shares — priced at AUD 2.15 per share for institutional investors and AUD 2.00 per share for retail investors, raising approximately AUD 5.7 billion and listing the company on the ASX under ticker MPL. Shortly after listing, in October 2015, Medibank divested its Workplace Health and Travel Doctor businesses to Sonic Healthcare following a strategic review, signalling a shift toward its core insurance and broader health services focus.

George Savvides retired as Managing Director and Chief Executive Officer in March 2016 after approximately 14 years, with Craig Drummond appointed as his successor effective 4 July 2016. Drummond oversaw a significant pivot toward integrated healthcare delivery, including the July 2017 acquisition of HealthStrong, a mobile allied health services provider, for AUD 36.9 million; the August 2018 acquisition of Home Support Services (HSS), a national in-home clinical care provider; and in March 2019, the launch of a ‘no gap’ program covering out-of-pocket specialist fees. Craig Drummond departed as Chief Executive Officer on 17 May 2021.

Under subsequent leadership, primary care investment accelerated. In February 2021, Medibank acquired a 33.4% interest in Myhealth Medical Group for AUD 63 million, subsequently increasing its stake to 49%, then to 90.1% effective 5 January 2024 for a further AUD 52 million, and further to approximately 91% later in 2024. In March 2023, Medibank invested AUD 15.5 million to acquire a 50% interest in Integrated Mental Health (iMH) as a joint venture with Aurora Healthcare.

In October 2022, Medibank experienced a major cybersecurity breach characterised by APRA as one of the most significant data breaches in Australia. Credentials stolen from a third-party IT provider’s employee device in August 2022 enabled a threat actor to access Medibank’s network between late August and mid-October 2022, extracting approximately 520GB of data before publishing stolen records on the dark web between November and December 2022. APRA imposed an additional AUD 250 million capital adequacy requirement effective 1 July 2023 in response; that requirement remained in place as of 31 December 2025. Ongoing litigation and regulatory proceedings followed, including a 2025 Federal Court ruling requiring disclosure of certain technical reports (see Legal Claims for detail).

In October 2024, Medibank announced a three-year strategic technology partnership with League to embed a data and AI-driven healthcare consumer experience platform into its digital capabilities. In November 2025, Medibank agreed to acquire Better Medical — a network of 61 GP and medical clinics — from private equity firm Livingbridge for approximately AUD 159 million, completed on 16 December 2025, materially expanding its primary care clinic footprint. The full acquisition of health tech company Medinet was completed in February–March 2025, consolidating virtual GP platform capabilities. In August 2024, Medibank agreed to acquire Pinnacle Health Group, a corporate health and wellbeing provider, to accelerate its corporate health offering. In June 2025, Medibank and Ramsay Health Care announced a partnership to develop innovative care models in mental health, including virtual care and psychotherapy programs.

3) Key Executives

David Koczkar was appointed Managing Director and Chief Executive Officer of Medibank Private Limited on 17 May 2021, succeeding Craig Drummond. He originally joined Medibank in 2014 as Chief Operating Officer, served as Acting CEO from April to June 2016, and subsequently served as Group Executive – Chief Customer Officer until his permanent appointment. Prior to Medibank, Koczkar was Group Chief Commercial Officer at Jetstar from 2008 to 2014 and held director positions at Jetstar Pacific, Jetstar Hong Kong, and NewStar airline group. He holds a BCom, a Postgraduate Diploma in Finance, and is a Member of the Australian Institute of Company Directors (MAICD), and serves as a Member of the Council of Management for the International Federation of Health Plans.

Mark Rogers has served as Group Lead – Chief Financial Officer & Group Strategy since January 2017, with responsibility spanning finance, actuarial, treasury, internal audit, investor relations, procurement, group strategy, and mergers and acquisitions. He holds a Bachelor of Chemical Engineering and a Bachelor of Science, both from Monash University. Prior to Medibank, Rogers served as General Manager – Group Performance and Planning at NAB from 2013 to 2017, and previously as head of Strategy and Development at Mayne Group. He currently serves as a Director at Integrated Mental Health and on the board of Royal Children’s Hospital Melbourne.

Felicia Trewin joined Medibank in February 2024 as Group Lead – Data & Technology, succeeding Kylie Williamson who had held the role in an acting capacity. She brings over 28 years of experience in technology and transformation, having most recently served as Chief Technology Officer at AMP (appointed March 2022), and previously as Chief Information Officer at AustralianSuper. Her earlier career included senior roles at Microsoft, Deloitte, and Accenture. She is responsible for technology, information security, data, and digital platforms across the group.

Mei Ramsay has been a member of the executive leadership team since 2016 in the role of Group Lead – Trust, Legal & Company Secretariat and Company Secretary, combining the functions of Group General Counsel and Company Secretary. She has over 25 years of legal and governance experience, including serving as General Counsel at Cummins Inc. Asia Pacific and holding senior roles at Coles Myer Ltd and Southcorp Limited. Ramsay currently serves as Director and immediate past President of the Association of Corporate Counsel (ACC) Australia.

Anne-Marie Paterson joined the executive leadership team in February 2026 as Group Lead – Chief Risk Officer (acting), having previously led Enterprise Risk Management at Medibank. She is a risk executive and senior legal professional with over 24 years of experience, having formerly served as Chief Risk Officer and senior leader at AMP Limited, Bendigo and Adelaide Bank, Colonial First State, and CBA. She also serves as Board Advisory Member at Liberty IT Consulting Group and Rely Platform/Your Call.

Kylie Bishop has been a member of the executive leadership team since 2013 in the role of Group Lead – People, Spaces & Sustainability, joining Medibank in 2010 following earlier career experience in consulting and banking. She is a registered psychologist holding a BA (Hons) in Psychology and a Masters of Organisational Psychology, responsible for culture, capability, performance, reward, diversity and inclusion, health, safety and wellbeing, workplace relations, and the sustainability agenda. She currently serves as a Non-Executive Director at Royal Melbourne Hospital and Basketball Victoria.

Milosh Milisavljevic has served as Group Lead – Chief Customer Officer since joining the executive leadership team in June 2021, with responsibility for the Medibank and ahm brands, marketing, customer channels, health programs, and artificial intelligence initiatives. He joined Medibank in 2016 and previously held senior roles at SEEK and McKinsey & Company. He currently serves as a Director at Private Healthcare Australia Limited.

Meaghan Telford has served as Group Lead – Policy, Advocacy & Reputation since joining the executive leadership team in July 2023, having previously held the role of Senior Executive – Policy, Advocacy and Reputation at Medibank, which she joined in 2016. Her career spans over 20 years across sport, politics, and ASX-listed entities. She is responsible for government relations, health stakeholder engagement, policy, and corporate reputation.

4) Ownership

Medibank Private Limited is a publicly listed company trading on the Australian Securities Exchange (ASX) under the ticker symbol MPL. The 2014 IPO transferred 100% of Commonwealth ownership to public shareholders. There is no controlling shareholder or parent company; the Commonwealth retains no residual stake. Under the Medibank Private Sale Act 2006 (Cth), a 15% single-shareholder ownership cap applied following the IPO; that restriction ceased to apply on 1 December 2019, five years after the Commonwealth’s sale.

Per third-party data from Simply Wall St (as of May 2026, which has not been independently verified through primary disclosure), institutional investors hold approximately 51.8% of outstanding shares, with the general public holding approximately 48.1%. Individual insiders and private companies account for the remaining approximately 0.11% and 0.01%, respectively. The five largest disclosed shareholders, per the same source, are: AustralianSuper Pty Ltd (approximately 10.0%), State Street Global Advisors, Inc. (approximately 8.32%), BlackRock, Inc. (approximately 7.04%), The Vanguard Group, Inc. (approximately 6.01%), and JP Morgan Asset Management (approximately 3.54%). AustralianSuper increased its holdings with a purchase of 32,122,389 shares on 19 February 2026, reinforcing its position as the largest single shareholder.

The Board of Medibank Private Limited comprised nine directors as of 30 June 2025 — eight non-executive directors and the CEO. Following the 2025 Annual General Meeting on 19 November 2025, Linda Nicholls AO and David Fagan retired from the Board, while Jacqueline Hey and Dr Lisa McIntyre were elected as new directors effective 19 November 2025. Jay Weatherill AO subsequently retired effective 31 December 2025, following his appointment as Australia’s High Commissioner to the United Kingdom. At the 2024 AGM, shareholders approved a constitutional amendment increasing the maximum permitted number of directors from nine to twelve.

The current Board consists of nine members: Mike Wilkins AO (Chair), David Koczkar (CEO and Executive Director), Dr Tracey Batten, Gerard Dalbosco, Peter Everingham, Kathryn Fagg AC, Jacqueline Hey, and Dr Lisa McIntyre — all eight non-executive directors being independent. The Board Charter stipulates that the majority of directors must be independent non-executive directors ordinarily residing in Australia, and Medibank aims to maintain at least 40% female representation on the Board.

The Board maintains five standing committees. The Audit Committee is chaired by Gerard Dalbosco, with the charter requiring at least three non-executive members (majority independent) and cross-membership with the Risk Management Committee. The People and Remuneration Committee is chaired by Dr Tracey Batten. The Nomination Committee is chaired by Mike Wilkins AO (the Board Chair), consistent with the Nomination Committee Charter, which requires at least three independent directors; Company Secretary Mei Ramsay serves as secretary to this committee. The Investment and Capital Committee was previously chaired by Linda Nicholls AO until her retirement on 19 November 2025; current chair information for this committee was not available for extraction from the filed governance documents. The Risk Management Committee was chaired by David Fagan until his retirement on 19 November 2025; Gerard Dalbosco previously held a member role. In addition, the Board maintains a Cyber Response Board Committee as part of its cyber response framework.

5) Financial Position

Medibank Private Limited trades on the Australian Securities Exchange under the ticker symbol MPL. As of 7 May 2026, the stock closed at AUD 4.60, with a 52-week range of AUD 4.06 to AUD 5.31. Market capitalization stood at approximately AUD 12.67–12.83 billion as of early May 2026, per third-party data sources. The stock registered a -2.54% change over the prior 52-week period, and has delivered a 3-year trailing total return of approximately 45.55% and a 5-year return of approximately 84.11% as of 7 May 2026.

Revenue has grown consistently across the multi-year period under review: from AUD 7,807.0 million in FY23 to AUD 8,175.8 million in FY24 (4.7% growth), and to AUD 8,604.0 million in FY25 (5.2% growth). For the trailing twelve months ended 31 December 2025, revenue reached approximately AUD 8.77 billion. Underlying NPAT has also expanded materially: from AUD 398.7 million in FY21 to AUD 500.1 million in FY23, AUD 570.4 million in FY24, and AUD 618.7 million in FY25 — an 8.5% year-over-year increase. Statutory NPAT for FY25 was AUD 500.8 million (up 1.7% from AUD 492.5 million in FY24), reduced by AUD 128.0 million due to the adoption of AASB 17 Insurance Contracts. For the half-year ended 31 December 2025 (1H26), statutory profit after tax fell 11.0% to AUD 302.9 million compared to AUD 340.3 million in 1H25, with underlying NPAT broadly flat at AUD 297.8 million (down 0.3%).

Margin and profitability metrics reflect the characteristics of a regulated health insurer with a high-volume, lower-margin revenue structure. The Health Insurance segment operating margin was 8.5% in 1H26 (flat half-on-half), compared to 8.8% in FY24 and 8.6% in FY23. The net profit margin on a trailing twelve-month basis is approximately 5.28%, below an industry peer average of approximately 10.04%, while the operating margin of approximately 8.0% (TTM) also trails the industry average of approximately 18.3% — a structural feature of the private health insurance model given high claims pass-through. Return on equity (ROE) was approximately 20% (TTM) and return on assets (ROA) was approximately 10.4% (TTM) as of May 2026. The asset turnover ratio of approximately 2.07 substantially exceeds the industry average of approximately 0.66, consistent with the capital-light, high-volume insurance model.

The balance sheet as of 30 June 2025 showed total assets of AUD 4,700.3 million and total liabilities of AUD 2,364.4 million. Borrowings at 30 June 2025 were AUD 35.0 million, with total debt-to-equity of approximately 11.78% and interest coverage of approximately 60.25 as of 31 December 2025 — indicating a highly conservative leverage position. The current ratio and quick ratio were each approximately 2.2 and 2.17 respectively as of 31 December 2025, confirming a strong liquidity position. The company held AUD 648.6 million in cash and equivalents as of 30 June 2025.

From a capital adequacy standpoint, Health Insurance required capital was AUD 1,202.3 million as of 31 December 2025, representing 1.9 times the prescribed capital amount (PCA). The APRA-imposed additional AUD 250 million capital adequacy requirement — effective 1 July 2023 in response to the 2022 cybercrime event — remained in place as of 31 December 2025, representing a persistent regulatory constraint on capital deployment. The common equity Tier 1 capital base was AUD 1,849.8 million as of 30 June 2025. Unallocated capital stood at AUD 185.8 million as of 31 December 2025.

Operating cash flow on a trailing twelve-month basis was approximately AUD 298.6 million, with capital expenditures of approximately AUD 12.6 million and free cash flow of approximately AUD 286.0 million (FCF margin of approximately 3.26%). Cash stability is underpinned by government-regulated annual premium cycles — the average premium increase was 3.99% effective 1 April 2025 and 5.1% effective 1 April 2026 — providing a predictable revenue cadence. Net investment income of AUD 207.8 million in FY25 (up 14.1% from AUD 182.2 million in FY24) represents a meaningful secondary income stream, though it declined 17.1% to AUD 94.9 million in 1H26. The investment portfolio includes approximately AUD 240 million in domestic and international equities (as of 31 December 2024), with a 25 basis point movement in the RBA cash rate producing an approximate AUD 7 million annual impact on investment income.

The dividend payout ratio was 80.1% of underlying NPAT for both FY24 and FY25, with the FY25 total ordinary dividend of 18.0 cents per share representing an 8.4% increase over FY24. The 1H26 interim dividend was 8.30 cents per share (fully franked), with a payout ratio of 76.8%; management’s target for FY26 is 75–85% of full year underlying NPAT. Alongside dividends, M&A has been a primary capital deployment channel: management targeted AUD 150–250 million in acquisitions between FY24 and FY26, with the AUD 163.5 million acquisition of Better Medical (completed 16 December 2025) and approximately AUD 52 million deployed into Myhealth Medical Group in FY24 as the principal transactions.

Ongoing non-recurring cybercrime costs remain a material headwind: AUD 46.4 million in FY23, AUD 39.8 million in FY24, AUD 39.7 million in FY25, with approximately AUD 35 million expected for FY26. These costs, combined with the APRA capital overlay, represent the most significant financially quantifiable legacy of the 2022 breach. Regulatory proceedings initiated by the Australian Information Commissioner in June 2024 introduce unresolved litigation exposure. Concentration risk is inherent in the business given its near-exclusive Australian geographic focus, government-regulated premium structure, and dependence on the single Australian private health insurance market, partially offset by diversification across Medibank and ahm brands and growing Medibank Health earnings — which grew 27.0% to AUD 76.7 million in FY25.

6) Market Position

Medibank operates in a concentrated Australian private health insurance (PHI) market where, per company disclosures, the five largest insurers collectively account for over 82% of resident policies as of June 2024. The primary named competitors are Bupa, HCF, nib (NIB Holdings Limited), and HBF — all operating in the domestic Australian resident PHI market. The market is characterised by elevated switching rates — which remained elevated as of end-2025 per company disclosures — and cost-of-living pressures driving customers toward lower-tier products, dynamics Medibank publicly characterised as creating unsustainable competitive intensity as of February 2026. Barriers to entry include APRA prudential registration requirements, capital adequacy obligations, and the scale economics of provider network contracting; these structural factors reinforce incumbent positions.

Medibank holds a 26.5% resident policyholder market share as of 30 June 2025 (per the FY25 Annual Report), compared to 26.7% as of 30 June 2024 and 27.08% as of 30 June 2023 — indicating a modest decline over two years. The resident PHI industry expanded 2.1% in the 12 months to 31 December 2025 per APRA statistics referenced in company disclosures. Resident policyholders reached 2,021.1k as of 31 December 2025, growing 1.9% over 12 months, with the ahm brand growing 4.9% and the Medibank brand growing 0.8% over the same period. The ahm brand’s stronger growth trajectory — 4.3% in FY25 versus 0.3% for the Medibank brand — reflects its positioning as a simplified, lower-cost offering that appeals in a cost-of-living environment. The resident acquisition rate improved 40 basis points to 5.6% for the six months ending 31 December 2025. In the non-resident segment, overseas student health cover (OSHC) revenue market share reached 39.4% in FY24 (up from 32.0% in FY23), and Medibank is the preferred OSHC provider for nearly half of Australian universities as of June 2025 — a competitively differentiated and high-growth position. Non-resident policy units grew 11.6% in FY25 and increased a further 8.1k in Q3 FY26. The company is included on the ASX as a significant market capitalisation participant; index inclusion drives institutional visibility and passive fund flows.

Platform and engagement metrics reinforce competitive positioning. The Live Better rewards program expanded from 697,000 participants in FY23 to 931,000 in FY25 and crossed 1.01 million participants in 1H26 — a 13.6% year-on-year increase — with AUD 32.8 million in rewards redeemed in FY25. The proportion of resident policyholders engaged with health and wellbeing services grew from 46% in FY24 to 52% in FY25, reaching 55% in 1H26, indicating a strengthening platform flywheel. The My Medibank app recorded a 20% year-on-year increase in active users as of 30 June 2025, and 82% of ahm customers logged in via the mobile app in FY23. The primary care network encompassed 168 clinics and approximately 2,600 multidisciplinary health professionals as of 31 December 2025, following the Better Medical acquisition, with an aspiration to reach 10 million primary care consultations annually by FY2030. Amplar Health delivered 4.3 million health interactions in FY25 and 2.3 million patient interactions in 1H26 alone.

Key strategic partnerships provide differentiated service capabilities. The October 2024 partnership with League (three years) embeds a data and AI-driven healthcare consumer experience platform into Medibank’s digital and corporate health offerings, with integration into the My Medibank app targeted for early 2025. A partnership with Amwell supports digital chronic disease prevention programs. Specsavers’ optical and audiology partnership under Members’ Choice Advantage was renewed for five additional years in 2025. Travel insurance is arranged through Zurich Australian Insurance Limited, while pet insurance is underwritten by PetSure (Australia) Pty Ltd. Life Insurance and Income Protection products are issued by Zurich Australia Limited and distributed by NEOS Direct. The partnership with St John of God Health Care, announced in September 2025, expands the no-gap program to regional and metropolitan sites. Government partnerships include a 2025 collaboration with the Australian Federal Government to deliver virtual nursing services across 30 aged care homes, and a Transition Care Service partnership with SA Health that became operational in February 2025. As of June 2025, 81% of Medibank customers’ private hospital episodes at contracted hospitals were covered under partnership-based funding agreements. Medibank’s no-gap hospital network encompassed 41 sites as of 30 June 2025, generating AUD 3.3 million in out-of-pocket savings in 1H26, with one in five Medibank-funded joint replacements in Melbourne and Sydney now delivered through a no-gap hospital.

The company’s April 2025 average premium increase of 3.99% was below the industry weighted average of 4.38% and the lowest among the four largest funds, per company disclosures — a pricing discipline that supports customer acquisition and retention in a price-sensitive market but compresses near-term margin improvement. Technology infrastructure is being modernised through cloud, AI, and automation adoption, with 52 machine learning and AI models embedded as of 30 June 2025 and a modular architecture strategy underway. A 60% reduction in complaint resolution time through AI-assisted processes was reported as of 30 June 2025. Brand recognition is supported by Canstar’s Outstanding Value award for health insurance for 18 consecutive years as of 2026.

Employee engagement reached 8.1 out of 10 in FY25, up from 7.9 in FY24 and 7.7 in FY23, with an employee NPS of +38/+39 as of 30 June 2025. Approximately 30% of direct employees are covered by Enterprise Agreements, with 70% on individual contracts. The company is trialling a 4-day work week (100:80:100 model) with approximately 500 participants. Supply chain is predominantly domestic, with 92.5% of third-party suppliers and operational partners based in Australia across a network of more than 1,700 entities.

7) Legal Claims and Actions

The legal and regulatory history of Medibank Private Limited over the past decade is dominated by the consequences of the October 2022 cybercrime event, alongside a series of earlier consumer protection enforcement actions. The company is regulated by APRA as a registered private health insurer and supervised by the OAIC, as documented in prior sections. No matches were identified on the ASIC Banned and Disqualified Organisations register, Court Enforceable Undertakings register, or Public Warning Notices register as of the report date.

The 2022 cybersecurity breach — in which a threat actor used stolen contractor credentials to access Medibank’s VPN (which lacked multi-factor authentication) and exfiltrate approximately 520GB of data affecting approximately 9.7 million current and former customers — has generated multiple concurrent legal proceedings. APRA imposed an additional AUD 250 million capital adequacy requirement effective 1 July 2023, which remained in place as of 31 December 2025, conditional on completion of an agreed remediation program. On 19 June 2024, the Australian Information Commissioner (AIC) filed proceedings in the Federal Court alleging Medibank contravened section 13G of the Privacy Act 1988 (Cth) by failing to take reasonable steps to protect personal information under Australian Privacy Principle 11.1. Each contravention attracts a maximum civil penalty of AUD 2,220,000; given the 9.7 million individuals affected, the potential aggregate exposure is material. The matter remains pending court determination as of May 2026.

Separately, Medibank filed Federal Court proceedings (VID757/2023) to restrain the AIC from investigating a representative privacy complaint accepted in December 2023, arguing that the investigation would interfere with the administration of justice in relation to ongoing class actions. As of February 2026, the complaint remains with the OAIC pending determination of next steps.

The breach also spawned multiple class actions. A consolidated Federal Court proceeding (VID64/2023) combines claims originally filed by Baker McKenzie in February 2023 and Slater & Gordon; this consumer class action alleges breach of contract and contraventions of Australian Consumer Law. A separate consolidated shareholder class action (Robert Laird Kilah & Brendan Francis Sinnamon v Medibank Private Limited, S ECI 2023 01227) is proceeding in the Supreme Court of Victoria, alleging misleading or deceptive conduct and breach of continuous disclosure obligations concerning the adequacy of Medibank’s cybersecurity systems prior to the breach. In the Federal Court consumer class action (McClure v Medibank Private Limited [2025] FCA 167), the court ruled in April 2025 that certain investigation reports were not privileged; Medibank has sought leave to appeal that decision. Both the consumer and shareholder class actions remain ongoing as of May 2026. In January 2024, the Australian government imposed its first-ever cyber sanctions — travel ban and financial sanctions — against Russian national Aleksandr Gennadievich Ermakov for his role in the breach.

A secondary cybersecurity incident occurred in June 2023, when a third-party property management vendor suffered a cyberattack via MOVEit software, resulting in theft of certain Medibank employee contact details; Medibank confirmed its own systems were not impacted.

Prior enforcement history reflects two concluded ACCC matters. In July 2020, the Federal Court ordered Medibank to pay a AUD 5.0 million penalty and AUD 70,000 in ACCC costs, plus over AUD 775,000 in consumer compensation, for falsely advising approximately 849 ahm “Lite” and “Boost” policyholders between February 2013 and July 2018 that they were ineligible for joint investigation and reconstruction benefits when they were entitled. Medibank self-reported the breach and entered an enforceable undertaking. An earlier ACCC action filed in June 2016 — alleging misleading conduct related to limiting in-hospital pathology and radiology benefits — was dismissed by the Federal Court in August 2017; the Full Federal Court dismissed the ACCC’s appeal in December 2018. In a matter predating the current ten-year window (settled May 2004), Medibank agreed to establish a AUD 5 million fund and publish corrective advertising following misleading advertising campaigns in 2000. Additionally, ASIC’s 2023 review of general insurer pricing practices identified Medibank as a brand associated with The Hollard Insurance Company Pty Ltd’s collective AUD 9.4 million remediation for failures to deliver promised consumer discounts; the specific amount attributable to Medibank was not disclosed.

Cumulative quantified penalties over the ten-year period to May 2026 include the AUD 5.0 million ACCC penalty (2020), the AUD 250 million APRA capital adequacy adjustment (2023, ongoing), and unresolved potential OAIC civil penalties. The ASIC Hollard remediation quantum attributable to Medibank is unquantified. Ongoing cybercrime-related costs (AUD 46.4 million in FY23, AUD 39.8 million in FY24, AUD 39.7 million in FY25, with approximately AUD 35 million expected for FY26) represent additional financial drag documented in the Financial Position section.

No criminal convictions or professional licensing disciplinary actions involving current or former executives during their tenure at Medibank have been identified in available records. No employment-related litigation, discrimination cases, or workplace retaliation allegations have been identified in available public records. No bankruptcy filings or financial distress events have been identified. The pattern of legal matters is concentrated around a single systemic cybersecurity failure and a legacy of consumer-facing product disclosure issues; the cybercrime cluster in particular represents a sustained multi-year reputational and financial liability with unresolved regulatory and litigation exposure that remains the most significant legal risk facing the company.

8) Recent Media Coverage

Coverage of Medibank Private has been dominated, across the past three years, by the sustained narrative surrounding the 2022 cybersecurity breach and its expanding legal and regulatory consequences. This cluster of coverage has been extensive in scope, negative in tone, and genuinely sustained — recurring in waves as new proceedings and rulings have generated fresh news cycles. Financial press, legal and regulatory publications, technology media, and general business media have all contributed, making the cyber incident the most prominent single story associated with the company in the public record.

Financial press and major wire services provided the most intensive early coverage. Bloomberg’s November 2022 estimate of potential compensation and remediation costs in the range of AUD 700–960 million — published as customer data was actively being leaked — framed the breach as a large-scale financial liability event, not merely a technology failure. Reuters covered the APRA capital adequacy imposition in June 2023, framing it as regulatory punishment; the announcement was linked to a 4.6% intraday share price decline — the stock’s worst single-day drop since the breach disclosure — which financial outlets highlighted as evidence of ongoing investor sensitivity. The Australian Financial Review’s June 2024 reporting on the Australian Information Commissioner’s civil penalty proceedings characterized the potential maximum penalty in astronomical theoretical terms, amplifying market perception of open-ended financial exposure. Legal and compliance publications covered the April 2025 Federal Court privilege ruling — in which Medibank’s Deloitte investigation reports were held not to be protected by legal professional privilege — framing it as a cautionary case with broad corporate implications beyond Medibank itself. Reuters separately covered the filing of the fourth class action in June 2023, following the consolidation of proceedings, reinforcing a media narrative of compounding legal jeopardy. The cumulative effect of this coverage cycle has been to position the cyber breach as a multi-year reputational and financial overhang, a framing that has persisted into 2026.

Coverage of Medibank’s strategic pivot into health services delivery has been moderately positive in business and healthcare trade publications, though it has attracted a countervailing strand of critical industry commentary. The Australian Financial Review’s November 2025 coverage of the Better Medical acquisition framed it as a deliberate step in Medibank’s transition from insurer to health provider, with the AUD 200 million Medibank Health earnings target by 2030 frequently cited as the strategic anchor. However, this narrative was complicated by coverage from healthcare trade publications and public broadcaster media in late 2024 and March 2026, which gave prominent space to industry stakeholders — including hospital sector participants — raising conflicts-of-interest concerns around vertical integration. These outlets framed insurer ownership of GP clinics as creating potential incentives to channel patients toward insurer-owned facilities, a framing that has gained modest but notable traction in healthcare policy discourse.

Workplace culture initiatives generated positive but limited coverage. The four-day work week trial and its expansion following reported improvements in employee wellbeing metrics attracted brief, favourable coverage from general news media in October 2024, framed primarily as a human interest story rather than a material business development. Business media covered the 1H26 results in a mixed tone — noting the 11% statutory profit decline alongside a 6.4% increase in the interim dividend and the strong Medibank Health growth trajectory — reflecting the company’s dual narrative of legacy cyber costs and underlying operational progress.

Upcoming thought leadership participation, with Medibank’s Chief Customer Officer Milosh Milisavljevic scheduled to deliver a keynote at the Health Insurance Summit in Melbourne in July 2026, signals continued effort to maintain a constructive public and industry presence, though such participation has received limited standalone media coverage beyond event listings.

9) Strengths

Market-Leading Scale in Australian Private Health Insurance

Medibank’s position as one of the two largest participants in the Australian PHI market — in a market where the five largest insurers collectively hold over 82% of policies — confers structural advantages in provider network contracting, claims cost negotiation, and regulatory engagement that smaller funds cannot easily replicate. The dual-brand architecture (Medibank and ahm) allows simultaneous competition across premium and value segments, with the ahm brand demonstrating stronger recent growth and the ability to capture incremental share even as the primary brand faces switching pressure.

Dominant Non-Resident Health Cover Position

Medibank’s commanding OSHC revenue market share and its status as the preferred provider for nearly half of Australian universities as of June 2025 represent a competitively differentiated and high-growth niche. University partnership agreements create institutional switching costs that reinforce retention, and this segment operates with less direct government premium regulation than resident cover, providing incremental margin flexibility. Non-resident policy units have grown materially across FY25 and into Q3 FY26, reflecting the strength of this positioning.

Vertically Integrated Health Services Platform

Medibank’s Amplar Health network — spanning primary care clinics, virtual health, in-home clinical care, corporate health, and a mental health joint venture — creates an integrated care delivery capability uncommon among pure-play private health insurers. This platform generates both direct earnings and a defensible channel for directing insured patients into cost-controlled settings, which is the structural logic behind the AUD 200 million Medibank Health earnings target for FY2030. The Medibank Health segment’s 27.0% earnings growth in FY25 demonstrates that this integration is beginning to deliver measurable financial returns.

Digital Engagement and Platform Flywheel

The Live Better program’s growth past 1 million participants in 1H26 and the rising proportion of policyholders engaged with health and wellbeing services — from 46% in FY24 to 55% in 1H26 — indicate a strengthening platform flywheel. This deepening engagement creates a behavioural data asset that competitors without comparable platforms cannot access at scale, and the flywheel effect — where engagement improves claims predictability and customer retention — is a compound advantage over time.

AI and Technology Modernisation Capability

With 52 machine learning and AI models embedded as of 30 June 2025, a modular cloud architecture strategy underway, and a three-year technology partnership with League to embed an AI-driven healthcare consumer experience platform, Medibank is operationally advancing technology integration ahead of many mutual and not-for-profit competitors. The appointment of Felicia Trewin as Group Lead – Data & Technology in February 2024, with prior CTO and CIO experience at major Australian financial institutions, concentrates relevant enterprise transformation expertise at the executive level.

Sustained Brand Recognition and Award History

Canstar’s Outstanding Value award for health insurance held for 18 consecutive years as of 2026 represents an independently conferred, verifiable signal of competitive pricing and product value. This sustained recognition over nearly two decades provides a durable third-party credibility marker that underpins customer acquisition and retention at scale, particularly relevant given elevated market switching rates and cost-of-living sensitivity among policyholders.

Conservative Capital Structure and Liquidity Position

The balance sheet reflects highly conservative leverage and a strong liquidity position, with cash and equivalents and unallocated capital providing both the buffer to absorb ongoing cybercrime remediation costs and the deployment capacity to pursue the stated acquisition program. The capital-light model generates meaningful free cash flow without proportionate capital accumulation, supporting sustained dividend payments — with a payout ratio of 80.1% of underlying NPAT in FY25 — alongside active M&A.

Government-Regulated Premium Cycle as Revenue Predictability Anchor

Australia’s government-administered annual premium review cycle provides revenue visibility absent in most commercial insurance markets. The regulated structure also functions as a partial barrier to disruptive price competition, as rate increases require regulatory approval rather than being set unilaterally. Medibank’s ability to price below the industry weighted average while maintaining volume growth demonstrates disciplined use of pricing as a customer acquisition lever within the regulated framework.

Publicly Traded Status and Capital Market Access

Public company status provides Medibank with continuous access to equity and debt capital markets at institutional scale, enhanced transparency requirements under ASX Listing Rules and APRA prudential standards that reinforce institutional credibility, and independent board oversight. A stable, professionally scrutinised institutional shareholder base and a sustained multi-year total return track record support future capital raising at competitive terms and signal ongoing investor confidence in the company’s operating model.

Established Government and Institutional Partnership Network

Active operational partnerships with the Australian Federal Government, SA Health, and contracted arrangements covering 81% of private hospital episodes at contracted hospitals as of June 2025 create recurring revenue streams anchored in public sector relationships. These relationships, combined with a predominantly domestic supply chain across more than 1,700 supplier entities, reflect institutional embeddedness that would take years for a new entrant or smaller competitor to replicate.

10) Potential Risks and Areas for Further Due Diligence

Cybersecurity Breach: Ongoing Legal, Regulatory, and Financial Exposure

Severity: Critical. The 2022 cybercrime event remains the single most material risk facing Medibank, with multiple unresolved proceedings as of May 2026. The APRA-imposed additional capital adequacy requirement persists, constraining capital deployment. OAIC civil penalty proceedings remain pending, with maximum penalties applied across 9.7 million affected individuals representing a theoretically open-ended aggregate exposure. Both the Federal Court consumer class action and Supreme Court of Victoria shareholder class action remain ongoing. The April 2025 Federal Court ruling that Deloitte investigation reports are not privileged (under appeal) risks further evidentiary disclosure. Cybercrime-related costs have run at approximately AUD 39–46 million annually since FY23, with approximately AUD 35 million expected in FY26. This cluster is ongoing and unresolved. Due diligence should request current status of all proceedings, privilege appeal outcome, APRA remediation program completion timeline, and quantification of maximum OAIC exposure scenarios.

Market Share Erosion and Competitive Intensity Risk

Severity: High. Resident policyholder market share has declined from 27.08% in FY23 to 26.5% in FY25 — a trend Medibank’s management publicly characterised as creating unsustainable competitive intensity as of February 2026. Elevated switching rates, cost-of-living-driven downgrades to lower-tier products, and bifurcated brand performance indicate structural pressure on the primary brand. Statutory NPAT fell 11.0% in 1H26, and the Health Insurance operating margin was flat. Due diligence should examine policyholder lapse rates by product tier and brand, pricing gap analysis relative to key competitors, and whether the Medibank brand’s sub-1% growth reflects structural share loss or cyclical switching behaviour.

Vertical Integration Conflicts of Interest and Regulatory Scrutiny Risk

Severity: High. Medibank’s strategic expansion into primary care has attracted public industry commentary alleging potential conflicts of interest around insurer-owned GP clinics channelling patients toward insurer-owned facilities. This narrative has gained traction in healthcare trade publications and public broadcaster media in late 2024 and March 2026. The vertical integration model could attract regulatory scrutiny from competition or healthcare regulators. Due diligence should assess current ACCC or Department of Health regulatory engagement regarding vertical integration, the existence of internal governance protocols governing referral pathways between insurance and clinic arms, and public hospital sector positions on contracting with Medibank Health.

APRA Capital Adequacy Overlay and Remediation Program Risk

Severity: High. The AUD 250 million APRA capital overlay — representing roughly 21% of the AUD 1,202.3 million Health Insurance required capital as of 31 December 2025 — remains in place and is conditional on completion of an agreed cybersecurity remediation program. Failure to satisfy APRA’s remediation criteria would perpetuate this constraint indefinitely, reducing unallocated capital and limiting M&A and dividend flexibility. This requirement also carries implicit reputational signalling to institutional counterparties. Due diligence should request the specific APRA remediation program milestones, the regulator’s assessment of progress to date, and the anticipated removal timeline.

Better Medical Acquisition Integration Risk

Severity: Moderate. The AUD 163.5 million acquisition of Better Medical (completed 16 December 2025), adding 61 GP and medical clinics, represents Medibank’s largest discrete health services transaction and the most recent addition to a rapidly expanding Amplar Health portfolio that also absorbed Medinet (completed February–March 2025) and Pinnacle Health Group (announced August 2024) within a compressed timeframe. Integration of multiple clinic networks — each with distinct clinical governance, employment arrangements, and IT systems — into a coherent operating model carries execution risk. The company had not yet reported full-year metrics attributable to Better Medical as of May 2026. Due diligence should examine Better Medical’s pre-acquisition financial performance, integration planning documentation, and whether the 10 million annual consultation target is supported by capacity modelling across the combined clinic network.

Investment Income Volatility and Interest Rate Sensitivity

Severity: Moderate. Net investment income declined 17.1% in 1H26 after reaching AUD 207.8 million in FY25 — a deterioration that partly reflects portfolio rebalancing dynamics. Given that investment income represented a meaningful secondary earnings contributor in FY25, sustained rate cuts or equity market weakness could compress group NPAT beyond operating performance. Due diligence should obtain the current investment mandate and asset allocation, stress-test the portfolio under RBA rate reduction scenarios of 75–100 basis points, and assess whether the 1H26 decline is structural or temporary.

Chief Risk Officer Transition and Succession Risk

Severity: Moderate. Anne-Marie Paterson was appointed Group Lead – Chief Risk Officer in an acting capacity in February 2026, introducing uncertainty around continuity of regulatory engagement and risk governance at a time when APRA oversight is at its most intensive. Rob Deeming (Group Lead – Digital & Ventures) also departed in July 2025. Due diligence should confirm whether a permanent CRO appointment search is underway, assess Ms Paterson’s mandate relative to the APRA remediation timeline, and review the scope of the Cyber Response Board Committee’s oversight of the remediation program.

Sources

1] [Medibank Private Ltd: Homepage
2] [Medibank FY25 Full Year Results – Appendix 4E and Financial Report (AFR announcement)
3] [APRA Takes Action Against Medibank Private — Cyber Incident
4] [Australian Information Commissioner v Medibank Private Limited — Concise Statement (OAIC)
5] [Bloomberg: Medibank Hack Could Cost A$700 Million in Compensation, Fixes
6] [Reuters: Australia Regulator Asks Medibank to Set Aside $167 Mln After Data Breach
7] [AFR: Medibank Faces Maximum Fine in New Cyber Hack Case
8] [OAIC — Medibank Data Breach Alleged Timeline Infographic
9] [Reuters — Medibank IPO Pricing
10] [OAIC Representative Complaints — Medibank
11] [Supreme Court of Victoria — Medibank Private Group Proceedings
12] [Reuters — Medibank Faces Fourth Class Action Lawsuit Over Cyberattack
13] [AFR: Medibank Buys GP Network to Expand in Health Services
14] [Clayton Utz: Lessons from Medibank on Maintaining Legal Professional Privilege
15] [Medibank ASX Announcement (AFR Company Announcements)
16] [Simply Wall St — Medibank Private Ownership
17] [ACCC — Medibank to Pay $5 Million in Penalties for Misrepresentations to Members
18] [ACCC Undertakings Register — Medibank Private Limited
19] [Reuters — Medibank Served with Class Action Lawsuit
20] [ABC News: Calls for Closer Look as Private Insurers Move into GP Clinics