Medibank faces both a class action and civil penalties over a 2022 data breach in which a hacker moved undetected through its network for weeks and leaked 529 gigabytes of personal data under malicious filenames such as 'boozy', 'HIV' and 'abortions'. Plaintiffs allege basic security failures, including absent multi-factor authentication, poor asset documentation and inadequate testing and monitoring, could have prevented the breach.
