Australia’s Privacy Regulator Sues Medibank Following Massive Data Breach

The Australian Information Commissioner has brought civil penalty claims in the Federal Court, alleging that Medibank neglected Australians’ privacy rights by failing to take adequate measures to safeguard their data from being stolen and misused by bad actors.

As reported by Reuters, acting Commissioner Elizabeth Tydd, said: 

“We allege Medibank failed to take reasonable steps to protect personal information it held given its size, resources, the nature and volume of the sensitive and personal information it handled, and the risk of serious harm for an individual in the case of a breach.”

Two years ago, the bank reported a cyberattack in which an online criminal accessed and released the personal data of 9.7 million current and former customers. The information was then posted on the dark web in a data breach that stands as one of the most substantial in Australian history. The Federal Court in Australia holds the authority to impose a civil penalty of up to A$2.22 million (approximately $1.48 million USD) for each violation of the country’s Privacy Act.

In response to the breach, Australia’s banking regulator required Medibank to allocate an additional A$250 million in capital due to identified weaknesses in its information security protocols. Despite the allegations, Medibank has publicly stated its intention to contest the legal action.

The Commissioner emphasised that this case should act as a critical reminder for Australian companies to bolster their digital defences against cyber threats.

Over the past two years, Australia has experienced a surge in cyber intrusions, prompting the government to implement security reforms and establish an agency dedicated to overseeing government investments and coordinating responses to cyberattacks.

Know the risks

The lawsuit faced by MediBank illustrates the urgent need for robust cybersecurity measures and proactive risk management strategies to protect sensitive information and maintain regulatory compliance in an increasingly digital world.

The themes take centre stage this October at #RISK London, where industry leaders explore the importance of regulatory compliance, ethical responsibility, and user-centric practices in data processing standards in the AI era.