Medibank's 529GB breach: court weighs joint class action and OAIC case

For litigation and regulatory lawyers, the Federal Court's joinder decision will shape how Australia's most significant health data breach is litigated. The class action's push for a joint hearing with the OAIC's civil penalty case turns on overlapping technical evidence: cybersecurity architecture, alert triage, and four alleged control failures.

Medibank is now facing two major legal proceedings in the Federal Court of Australia over the 2022 cyberattack that exposed highly sensitive customer data. On Friday, Federal Court Justice Jonathan Beach heard evidence to determine whether a class action brought by impacted customers and civil penalty proceedings initiated by the Office of the Australian Information Commissioner should be heard jointly or as separate trials. The procedural decision carries significant weight because the underlying technical evidence, including Medibank's cybersecurity architecture and alleged control failures, overlaps across both matters. Wendy Harris KC, representing the class action, argued that hearing the cases together would serve the interests of justice, citing the interconnected technical issues at multiple stages. This dual litigation posture has transformed a 2022 data breach into a defining regulatory and tort moment for Australian privacy law.

“

Medibank is now facing two major legal proceedings in the Federal Court of Australia over the 2022 cyberattack that exposed highly sensitive customer data.

According to evidence before the court, the initial unauthorized access to Medibank's network was obtained in August 2022 through the personal computer of a third-party contractor. From that beachhead, the attacker did not simply download a database; instead, the intruder moved laterally through the network over a period of weeks, gradually escalating privileges and mapping Medibank's systems. The court was told that Medibank's own security systems generated several alerts during this period, but those 'canary warnings' were effectively ignored. Some alerts were not triaged at all, while others were reviewed and closed as false positives or benign activity. This failure to respond to detection signals is likely to become a central issue in both proceedings, because it speaks directly to the reasonableness of Medibank's security controls and whether the company failed to meet its obligations under Australian privacy law.

The scale of the exfiltration was significant: the hacker ultimately extracted 529 gigabytes of customer data. After Medibank declined to pay a ransom, the stolen data was leaked on the dark web under file names designed to maximize harm, including 'boozy', 'STD', 'psycho', 'abortions', 'HIV', 'hepatitis', 'good list', and 'naughty list'. These labels are not incidental. They indicate that the attacker had enough time and access to categorize some of the most sensitive medical and personal information held by a health insurer. The class action alleges four core failures in Medibank's security controls, a framework that will likely shape both liability and damages arguments. For affected customers, the exposure of reproductive health, sexually transmitted infection, and mental health-related data elevates the potential for non-economic loss, identity theft, and targeted extortion.

For Medibank, the stakes of the joinder decision are substantial. A joint hearing could streamline expert evidence, reduce duplication, and create a consistent factual record across both the class action and the regulator's civil penalty case. However, it also amplifies the narrative of systemic security deficiencies before a single judge, potentially increasing the overall financial exposure. If the cases proceed separately, Medibank may face inconsistent findings or repeated litigation over the same technical evidence. The regulator's civil penalty proceeding is especially consequential because it tests the current penalty regime under the Privacy Act, and a finding against Medibank could set a benchmark for how Australian courts treat large-scale health data breaches involving third-party contractor access and ignored alerts.