Health insurer Medibank's data breach diagnosis keeps getting worse