The Office of the Australian Information Commissioner (OAIC) filed civil proceedings against Medibank in the Federal Court, alleging serious interference with the privacy of approximately 9.7 million individuals. The data breach is expected to cost Medibank more than $125 million.

This was due to Medibank’s failure to protect their personal information, breaching Australian privacy law. The OAIC also claimed that Medibank was aware of significant deficiencies in its cyber security and information security framework for at least 18 months before the hack, including the lack of MFA.