THEN WHAT?
Menu
TechnologyAustralia · 2022

What happened after the Medibank data breach?

The early cyberattack disclosure became a much larger data breach, followed by customer claims, a regulator’s penalty case and a separate privacy complaint.

This update: 2 October 2026 · Latest recorded development
Article revised 11 October 2026

THE ORIGINAL STORY13 October 2022
Daniel Newell
13 October 2022
Medibank Private reveals cybersecurity attack, cuts access to customer-facing systems to curb data loss
Medibank building signage in The West Australian’s original cyberattack reportScott Barbour / Getty Images · via The West Australian
Read the original report

A possible cyberattack became a major customer-data breach.

On 13 October 2022, reports in The West Australian and ABC News carried Medibank’s disclosure that it had detected unusual activity and taken some customer-facing systems offline. The company initially said it had no evidence of sensitive data being accessed. The exact first-day headlines and the newspaper’s credited building photograph preserve that initial account. Subsequent disclosures changed the scale of what was known. The follow-up is how the breach developed and where the attempts to secure accountability and remedies now stand.

ABC News

ABC News · 13 October 2022

Health insurer Medibank Private hit by cyber attack

THEN WHAT?

The breach grew into separate legal proceedings. Customers are still waiting for outcomes.

Symbolic dot-screen illustration of a medical cross and padlock

Medibank’s October 2022 disclosure was followed by confirmation that personal information for around 9.7 million people had been accessed. Customer and regulator proceedings followed. At an October 2026 hearing, the Federal Court was considering how the two cases should be heard, according to AAP. A separate privacy complaint also remains in progress. The reviewed records establish ongoing proceedings, with compensation and court outcomes still unresolved.

The story, in dates

Event dates
Scroll back through the story
  1. “Medibank Private reveals cybersecurity attack, cuts access to customer-facing systems to curb data loss”

    The West Australian · Original headline

  2. Scale confirmed

    The company described around 9.7 million people affected.

  3. Customer cases consolidated

    Two cases became one customer proceeding.

  4. Regulator case filed

    A separate penalty claim went to court.

  5. The representative complaint was still progressing

    There is also a representative complaint before the OAIC.

  6. How to hear the cases

    A court hearing addressed the next procedural steps.

7 November 2022

The initial account changed as the investigation progressed

The first reports carried Medibank’s statement that it had not found evidence of sensitive customer data being accessed. By 7 November, its public company release said it believed names and other personal details for around 9.7 million current and former customers and some authorised representatives had been accessed. Health-claims information was also affected for a smaller group. Medibank said it would not pay a ransom. The early reassurance was therefore an initial position, rather than the eventual account of the breach. The OAIC later recorded that personal information was released on the dark web.

Medibank cybercrime update · 7 November 2022 · public company release · Privacy penalty proceeding · OAIC · 5 June 2024

1 August 2023

Two customer cases became one proceeding

Slater and Gordon’s case page says the Federal Court approved consolidation of its customer class action with the Baker McKenzie case on 1 August 2023. Baker McKenzie would take sole responsibility for the consolidated proceeding. The funder’s current overview identifies the consolidated customer case separately from regulator action. This consolidation brought the customer proceedings together; it did not establish that the customers had won, settled or received compensation.

Customer class-action consolidation · Slater and Gordon · 1 August 2023 · Consolidated customer case · Omni Bridgeway · current overview

5 June 2024

The privacy regulator brought a separate penalty case

The Australian Information Commissioner filed civil penalty proceedings alleging that Medibank failed to take reasonable steps to protect personal information, seriously interfering with the privacy of 9.7 million Australians. The OAIC said whether penalties would be imposed, and their amount, were matters for the Federal Court. Medibank’s FY25 financial report says it is defending the proceeding. A regulator’s penalty claim is distinct from the customers’ claim for compensation; the allegation does not become a court finding simply because a case has been filed.

Privacy penalty proceeding · OAIC · 5 June 2024 · Company position · Medibank FY25 financial report · note 12

September 2026 · reported in October

The representative complaint was still progressing

There is also a representative complaint before the OAIC. Its public notice records acceptance of that complaint in March 2023. In an October 2026 update, Maurice Blackburn says the OAIC advised in September that it was continuing to progress the matter. The firm says the next steps remain for the OAIC to decide after submissions from both sides. This complaint is another process, separate from the Federal Court penalty case and consolidated customer class action. The update does not announce a final compensation award.

Representative complaint · Maurice Blackburn · October 2026 update · Representative complaint notice · OAIC · 3 June 2024

2 October 2026

The court considered how the two Federal Court cases should be heard

AAP’s report of the 2 October hearing says Justice Jonathan Beach was considering whether the regulator’s case and the customer class action should be heard together or in separate trials. A lawyer for the customers supported a joint hearing; Medibank’s lawyer said additional time was needed to address changes in the customer allegations. AAP reported an adjournment until 16 October, partly to allow the customer claim to be consolidated in its pleading. That is a future procedural step, rather than an announced settlement or liability decision.

Court hearing · AAP via Michael West Media · 2 October 2026

The evidence

Sources for this update

  1. 01Medibank cybercrime update · 7 November 2022 · public company release
  2. 02Customer class-action consolidation · Slater and Gordon · 1 August 2023
  3. 03Privacy penalty proceeding · OAIC · 5 June 2024
  4. 04Company position · Medibank FY25 financial report · note 12
  5. 05Representative complaint · Maurice Blackburn · October 2026 update
  6. 06Court hearing · AAP via Michael West Media · 2 October 2026
  7. 07Representative complaint notice · OAIC · 3 June 2024
  8. 08Consolidated customer case · Omni Bridgeway · current overview

Where the story stands

The story continues when the evidence does.

The latest reviewed records describe ongoing proceedings. The reported 16 October hearing is ahead of this article’s verification date; a later court order, decision or complaint determination could change the position. We will follow those records and distinguish procedural progress from a final ruling, settlement or actual payment.

Stay updated

Still wondering about another story?

Tell us what you remember. We'll follow up...

Ask Then What? →
No exact headline needed.
Request a follow-up →
We’ll use your email only to handle this request and let you know if it’s published. No newsletter signup.Add a name to be credited publicly if your question becomes a story. Leave it blank for a “Requested update” stamp.Your email stays private. Requests are reviewed; publication is not guaranteed. We use your details only for this request, as explained in our privacy notice.
Next: your email. No newsletter signup.