Medibank says hacker accessed data of 9.7M customers, refuses to pay ransom

Ok. They won't pay the ransom. Fine. Now how much are they going to pay in fines and restitution to the people harmed by their failure to protect?