Slater and Gordon issues class action against Medibank over data breach affecting millions of customers

Leading class action law firm Slater and Gordon has issued proceedings against Medibank on behalf of former, existing and prospective customers whose highly sensitive personal information was compromised – and published on the internet – in the October 2022 data breach.

The claim extends to customers of Medibank’s subsidiary Australian Health Management (ahm) as well as customers of Medibank’s travel insurance products. Impacted children whose information was affected are also in the class, as are authorised representatives and providers.

The statement of claim, lodged in the Federal Court of Australia, alleges that Medibank and ahm breached privacy and consumer laws as well as legislation that governs customer data retention and data protection for private insurers operating in Australia.

The allegations include that Medibank and ahm:

• failed to protect or take reasonable steps to protect customers’ personal information from unauthorised access or disclosure;
• failed to destroy or de-identify former customers’ personal information; and,
• failed to comply with legal obligations in collecting, using, storing and disclosing customer information.

The class action also alleges that Medibank breached its contractual obligations to customers to whom it assured it had “adequate and appropriate security controls in place” to protect their information.

Group members are seeking compensation for losses the data breach caused, including time and money spent replacing identity documents in addition to other measures to protect their privacy and prevent the increased likelihood of them falling victim to scams and identity theft. They are also seeking damages for non-economic losses such as distress, frustration and disappointment.

Between 9 November 2022 and 1 December 2022, Medibank revealed that stolen customer information was progressively released on the internet including information about customers who were diagnosed with HIV, had received treatment for drug and alcohol addiction and treatment for mental health issues. At least 9.7 million Medibank customers had personal information such as names, dates of birth, addresses, phone numbers and email addresses posted online.

Medicare card numbers of at least 2.8 million Medibank customers were also released, and health claims data in respect to at least 480,000 customers, passport numbers and country of issue, verbal identification passwords, employers, employee ID numbers and visa details were among an unknown number of other customer information that was compromised.

Slater and Gordon Class Actions Practice Group Leader Ben Hardwick described it as “one of the most serious data breaches in Australia’s history given the number of people whose information was compromised, and the nature of the information disclosed.

“Health information is something most people keep incredibly private and want kept between them, their doctors or health providers, and their insurer,” Mr Hardwick said.

“Yet for hundreds of thousands of Medibank and ahm customers who were caught up in this data breach, their sensitive health information was exposed on the internet for all to see. And for millions more, information critical to their data and personal security was also compromised.

“Medibank should have had adequate measures in place to prevent all of this, yet they didn’t.”

Mr Hardwick said thousands of former, current and prospective customers had already registered to join the class action.

The lead applicant, who does not want his name disclosed so as not to further compromise his privacy, said after seeing that ahm was a brand owned by Medibank when he joined, he assumed and trusted that meant everything was in check.

“I feel really exposed and unsettled knowing personal information of mine is out there, and there’s nothing I can do about it,” he said.

The class action filing comes within weeks of Slater and Gordon issuing proceedings against telecommunications and internet provider Optus over its 2022 data breach in which up to 10 million customers and former customers’ personal information was compromised.

The firm also continues to act for more than 1,000 refugees who succeeded in a landmark representative data breach complaint against the Australian government after their personal information was released online in 2014.

For more information about Slater and Gordon’s Medibank data breach class action, visit:

https://www.slatergordon.com.au/class-actions/current-class-actions/medibank