A cyber attack on health insurer Medibank is likely to cost the company up to $35 million in the first half of the financial year, its chief executive will tell shareholders.

“Based on our current actions in response to the cybercrime event, we currently estimate $25 million to $35 million of pre-tax non-recurring costs will impact earnings in the first half of 2023,” Chief Executive David Koczkar will say in his address at Wednesday’s annual general meeting in Melbourne.

“These non-recurring costs do not include further potential customer and other remediation, regulatory or litigation related costs.”

Australia’s biggest private health insurer is in the middle of a massive data hack, with hackers stealing personal information from all of the health insurer’s 9.7 million former and current customers.

The hackers, who police said were from Russia, have been releasing the stolen information in daily batches with Medibank refusing to pay ransom of $9.7 million.

“We are steadfast in our resolve to not reward this criminal behaviour, nor to strengthen a business model that is based on extortion. This is a watershed moment for our community – a harsh reminder of the new frontier in cybercrime that we all face,” Mr Koczkar will say.

The cyber attack has overshadowed the health insurer’s strong operating performance. It had lifted dividend in the 2021-22 financial year despite a dip in full year profit to $393.9 million.

At the time of its results in August, Medibank forecast policyholder growth of 2.7 per cent for the current fiscal, but has since withdrawn its guidance due to the uncertain impact of the hacking attack.

The company will now provide an update at its half-year results in February, Mr Koczkar will say.

Medibank’s net resident policyholder numbers were up 14,500 as at November 12 and its non-resident business has seen customer growth of 14 per cent in the September quarter.

The company still expects underlying net claims expense per resident policy unit to be 2.3 per cent for the full year and Mr Koczkar will say the business remains strongly capitalised.

This comes as law firm Maurice Blackburn reviews whether Medibank customers affected by the data could be entitled to compensation.

– AAP