Medibank facing dual court actions over data hack

A hacker infiltrated Medibank's network undetected for weeks, despite numerous warning signs, according to court proceedings. The health insurer is currently facing a class action lawsuit by affected customers and civil penalties from the privacy watchdog over the 2022 data breach. Medibank opted not to pay a ransom demand, and the hacker subsequently leaked personal information on the dark web, using file names such as "boozy," "STD," and "psycho."

Federal Court Justice Jonathan Beach heard arguments on Friday to determine whether the cases should be combined or heard separately. The class action lawyer argued for a joint trial, as the technical issues and control deficiencies in Medibank's cybersecurity systems intersected at various stages. The hacker initially breached Medibank's network in August 2022 through a third-party contractor's personal computer.

The breach involved a gradual progression through the network over several weeks, with multiple alerts raised but often ignored or dismissed by Medibank as false positives.

The hacker gained increasingly higher-level access to the network and extracted 529 gigabytes of customer data, which was then released under names indicating the sensitive nature of the information, such as "hiv," "std," and "abortion." The class action lawsuit alleges four core failures by Medibank to protect customer data, including the absence of multi-factor authentication, improper documentation of IT asset changes, and inadequate security testing and monitoring.

In response, Medibank's lawyer questioned the breadth of the class action, stating that their case has expanded significantly since the initial allegations. Justice Beach adjourned the matter until October 16 to allow the class action party to finalize its statement of claim.