Medibank bosses will still take home bonuses worth $7.3 million despite a massive data breach that exposed the health records of almost 10 million Aussies, including Prime Minister Anthony Albanese. 

The clean up bill in the aftermath of the data breach is expected to cost between $35m and $150m, but executives will still keep their bonuses. 

Chairman Mike Wilkins says executive pay would not be reviewed until next year, following the completion of an external review into the attack.

'That's something that we will take on board for the 2023 year once we have got the full results of the investigation,' Mr Wilkins said.

CEO David Kockzar took home bonuses worth $1.1 million in the last financial year, with his total pay coming in at $2.59m.

Executives on Wednesday stood by their call not to pay a ransom to Russian hackers who stole millions of customers' personal data.

But shareholders Mr Wilkins Wilkins why the health insurer hadn't taken cyber security 'as seriously as you should have' at the insurance giant's annual general meeting.

Mr Wilkins said: 'Medibank aims to reward executives fairly for delivering the company's strategy in a manner that meets community and customer expectations and delivers sustainable shareholder returns'.

The meeting comes a month after hackers stole personal information of the insurer's 9.7 million current and former customers.

The company confirmed to investors the up-front cost for the first half of the financial year would be $25m to $35m before factoring in legal and other expenses.

One 'rather disappointed' shareholder asked if IT security would form part of the company's recently-announced external review, also wondering if the executive responsible would have their pay cut.

Mr Wilkins said executive remuneration would be taken care of at the end of the next financial year, but said pay would be linked to performance.

'The board is very well aware of the alignment between remuneration and outcomes,' he said.

A representative of the Australian Shareholders Association asked when specific accountability would be taken for the breach, but Mr Wilkins said that would come after the review was complete.

The company has starting contacting about 480,000 customers it believes had their health data stolen.

'Safeguarding our customers' data is a responsibility we take very seriously and we will continue to support all people who have been impacted by this crime,' Mr Wilkins said in his opening address.

'There is no doubt that this crime is having an enormous impact on our customers and our community.

This is a shocking crime, the size and scale of which we have never seen before.'

But Mr Wilkins said paying a $US9.7m ransom was never an option and would have supercharged the hacking industry.

'There was a limited chance paying a ransom would ensure the return of our customers' data and prevent it from being published,' he said.

'The advice we have had is that to pay a ransom could have had the opposite effect and encouraged the criminal to directly extort our customers.'

The hackers had indicated they'd watch the meeting before firing off another tranche of stolen data.

'We'll announce that next portion of data we'll publish at (sic) Friday, bypassing this week completely in a hope something meaningful happened on Wednesday,' the hackers wrote in an update.

Mr Koczkar said the company had started the 'incredibly complex' process of contacting half a million customers whose sensitive data had been taken.

'This ongoing work continues and requires our people to analyse millions of records across numerous applications and Bonus New Member match customer data from multiple sources,' he said.

A 100 officer-strong cybercrime operation targeting the hackers will be led by the Australian Federal Police and Australian Signals Directorate.

Data including names, phone numbers, Medicare numbers and sensitive health information was taken by the hackers during the breach.