A cybercriminal individual or group demanding a ransom has threatened to release Medibank client data as Australia's largest health insurer faces a possible class action over the hacking of sensitive information for 9.7 million current and former customers.

Medibank has confirmed almost 500,000 health claims were accessed and the personal details of former and current customers were exposed when an unnamed group hacked into its system weeks ago.

Around midnight, an individual or group posted a ransom demand to its dark web blog that "data will be publish [sic] in 24 hours".

"P.S. I recommend to sell medibank [sic] stocks."

By the close of trade on Tuesday, Medibank shares were down around 1.8 per cent at $2.78, having traded even lower earlier in the session amid the threats of the data leak and potential class action lawsuits.

UNSW cybersecurity expert, Professor Richard Buckland, said it is impossible to be sure if the threat is genuine.

"We can't know for sure that it is the hackers that have posted it, because no data was posted with it, but it looks very plausible," he told ABC News.

"It's exactly what we're expecting once they were told they weren't going to be paid the ransom.

Cybersecurity expert Tony Hunt agreed with that assessment.

"This is horrendous, but not unsurprising if you look at ransomware like a business," Mr Hunt posted.

Derivative attack?

However, Professor Buckland said it was also possible that this threat was an act of attempted share market manipulation.

"There is a possibility, of course, that this announcement that the data's going to be released isn't from the group that has the data, but is instead some sort of what we call a derivative attack," he added.

"In an attempt to depress the share price someone may have short sold Medibank — sold more than they have, wait for the share price to drop after this announcement, after the threat, and then buy it back — it's a way of actually making more money than the ransom sometimes."

Henry Jennings, a market strategist and commentator with Marcus Today, said that if the hackers were motivated by short-selling Medibank then they have already had a big payday.

"If you were in that business of shorting shares, then you've already done pretty well," he said.

"Shorting is basically when you sell shares that you don't own, on the basis that you buy them back at a lower price and thus make a profit."

'Distressing development'

The company released a statement this morning noting that it was aware of media reports of the "purported threat" to released hacked customer data.

"Customers should remain vigilant," said Medibank chief executive David Koczkar in the statement.

"We unreservedly apologise to our customers. We take seriously our responsibility to safeguard our customers and support them.

"The weaponisation of their private information is malicious, and it is an attack on the most-vulnerable members of our community."