"We already expected capital returns would be unlikely in this environment given the focus after the cyberattack," he said. "APRA's imposition of an increase in Medibank's capital adequacy requirement … confirms that, aside from its ordinary dividend, Medibank will be unable to return capital to shareholders in the near term." Although Medibank has already addressed the specific control weaknesses that permitted unauthorised access to its systems, it still has more work to do across a number of areas to boost its security environment and data management, APRA said. The regulator's action is likely to "raise concerns about further potential cyberattack related impacts" on Medibank, Pittaway said. APRA will also conduct a targeted technology review of Medibank, with a focus on governance and risk culture.