Medibank has admitted that ever one of its customer had their data stolen during its breach, meaning more than 4 million Australians have been impacted.

CEO David Koczkar confirmed the news this morning, after yesterday informing the ASX the hack was bigger than first reported.

Given Medibank has 3.8 million current customers, and is required by law to keep past records for seven children and children until they turn 25, the number of Aussies impacted is likely to be well over 4 million.

“Our investigation has now established that this criminal has accessed all our private health insurance customers personal data and significant amounts of their health claims data,” he said.

“As we’ve continued to say we believe that the scale of stolen customer data will be greater and we expect that the number of affected customers could grow substantially.”

Medibank estimates a $25 million to $35 million one-off hit from the breach, in addition to whatever astronomical figure it will be forced to compensate customers with.

“These non-recurring costs do not include further potential customer and other remediation, regulatory or litigation related costs,” Medibank said.

Not surprisingly, after halting trading for a week, Medibank’s shares fell 14 per cent this morning.

“This cybercrime event continues to evolve and at this stage, we are unable to predict with any certainty the impact of any future events on Medibank including the quantum of any potential customer and other remediation, regulatory or litigation related costs.”

This is a long way from Medibank’s initial October 12 claims that no customer data had been taken during the hack.