AFP Commissioner Reece Kershaw says the cyber criminals behind the Medibank attack are “operating like a business with affiliates and associates who are supporting the business”.