9 News: The group allegedly responsible for Medibank's "cyber incident" has threatened to sell customer data unless the insurance company pays a ransom.

Medibank: This is a new development and Medibank understands this news will cause concerns for customers and the protection of their data remains our priority. Medibank is working urgently to establish if the claim is true, although based on our ongoing forensic investigation we are treating the matter seriously at this time.

Exactly like THE Science - deny it black n blue, then when you can't deny it a second longer, say: ongoing investigations have revealed a new development ...

David Koczkar, CEO:
I apologise and understand this latest distressing update will concern our customers. Our team has been working around the clock since we first discovered the unusual activity on our systems, and we will not stop doing that now. We will continue to take decisive action to protect Medibank customers, our people and other stakeholders.

The thing about data-leaks is it's a bit late for decisive action after it's happened. You can be as decisive as you like, you're not get that data toothpaste back in the tube.

We have always said that we will prioritise responding to this matter as transparently as possible.

Always saying & doing are two different things, apparently:

9 News: Medibank announced last week it had been hit by a "cyber incident" but reassured customers their personal data remained safe. No such reassurance was provided by the health insurer to customers today.