Medibank hit with fresh class action after data hack

The law firm's statement of claim, filed in the Federal Court, alleges Medibank and its subsidiary Australian Health Management breached privacy and consumer laws as well data retention legislation. 

Members of the class action are seeking compensation for losses, including time and money spent replacing identity documents.

They are also seeking damages for non-economic losses like distress, frustration and disappointment.

In a statement to the ASX, Medibank said it planned to defend the proceedings.

"Medibank continues to support its customers from the impact of the cybercrime through our previously announced cyber response support program which includes mental health and wellbeing support, identity protection and financial hardship measures," it said.

At least 9.7 million Medibank customers had personal information including names, dates of birth, addresses and phone numbers compromised during the October 2022 data breach.

Medicare card numbers of at least 2.8 million customers were also released online, along with health claims data of 480,000 customers.

"This was one of the most serious data breaches in Australia's history," Slater and Gordon class action practice group leader Ben Hardwick said.

"Medibank should have had adequate measures in place to prevent all of this, yet they didn't."

In a recent investor update, Medibank said the company was expected to spend up to $45 million on non-recurring expenses related to the hack.

It noted the figure excluded further potential remediation and litigation-related costs.

Slater and Gordon's class action follows similar compensation claims from law firm Baker & McKenzie and legal firm Quinn Emanuel on behalf of Medibank shareholders.

Several other firms have flagged they will file similar actions against Medibank, including a conglomerate involving Maurice Blackburn Lawyers, Bannister Law Class Actions and Centennial Lawyers.