Trading of the company's shares remains suspended. A spokesperson said in a statement: "For the avoidance of doubt, the voluntary suspension continues until the earlier of a release of a further announcement by Medibank and commencement of normal trading on 26 October."

The spokesperson added: "We have received a series of additional files from the criminal. We have been able to determine that this includes:

"A copy of the file received last week containing 100 ahm policy records – including personal and health claims data;

"Files which contain some Medibank and additional ahm and international student customer data.

When it first announced its systems had been breached, it said there was no indication of any sensitive data having leaked. Later, Medibank said the data stolen was limited to ahm and international students.

The spokesperson said: "Given the complexity of what we have received, it is too soon to determine the full extent of the customer data that has been stolen.

"We will continue to analyse what we have received to understand the total number of customers impacted, and specifically which information has been stolen."

Chief executive David Kockar said: “I unreservedly apologise to our customers who have been the victims of this serious crime.

“As we continue to uncover the breadth and gravity of this crime, we recognise that these developments will be distressing for our customers, our people and the community – as it is to me.

“This is a malicious attack that has been committed by criminals with a view of causing maximum fear and damage, especially to the most vulnerable members of our community.

“We continue to work closely with the agencies of the Federal Government, including the ongoing criminal investigation into this matter. We thank them for their ongoing support and assistance.”

Security researcher Brett Callow, a ransomware specialist at security firm Emsisoft, advanced one reason why he thought such demands were being made.

"At this point in time, a breach is likely to attract more attention from Australian media and legislators than it otherwise would," he said.

"And cyber criminals may believe that means Australian companies will be more likely to pay."

The Medibank breach is one of eight to be reported in the space of a month, the others being Optus, Telstra, G4S, Costa Group, Dialog, MyDeal and EnergyAustralia.