Medibank has denied breaching privacy rules in response to the regulator’s case over a 2022 cyber attack, but has admitted sensitive data was hacked in part because its network lacked multi-factor authentication.