Medibank faces simultaneous class action and privacy regulator case over 2022 data breach

Federal Court Justice Jonathan Beach heard arguments on Friday about whether Medibank’s class action and the privacy regulator’s civil penalty case should be combined. The lawsuit stems from a 2022 intrusion that began via a third-party contractor’s PC and persisted for weeks, during which Medibank ignored several security warnings. The attacker extracted 529 GB of data, later released on the dark web with labels such as "boozy," "STD," and "psycho."

The class action claims Medibank failed to implement multi-factor authentication, document IT changes, and conduct adequate security testing and monitoring. The privacy watchdog is seeking penalties for the same breach. Counsel for the plaintiffs argues the technical issues overlap, while Medibank’s lawyer describes the claims as a "total mess" and notes recent amendments to the case. The court adjourned the hearing to October 16 to allow the class action to finalize its claim.