Medibank Data Breach 2022 Investigation

The complaint alleges Medibank breached privacy laws and failed to adequately protect the personal and health information of its current and former customers.

If you would like to receive updates about the progress of the complaint made to the OAIC, and you are a current or former Medibank, ahm or international student customer, you requested a health insurance quote from ahm, and/or Medibank has told you that your information was accessed or published in the data breach, please register.

What information has been compromised?

The compromised data in the Medibank data breach includes current and former customers' names, dates of birth, addresses, phone numbers and emails, some Medicare card numbers, some passport numbers and health claim data (service provider name and location, where customers received certain medical services, and codes associated with diagnosis and procedures administered), some next of kin contact details for My Home Hospital patients and health provider details, including names, provider numbers and addresses.

Am I affected?

You are eligible to register to receive updates about our potential claims against Medibank (including a representative complaint lodged with the OAIC) in relation to the data breach if you fall into one or more of the following three categories:

(1) You (or a person you represent) are a current or former Medibank, ahm or international student customer;

(2) You (or a person you represent) are a potential health insurance customer who requested a quote with ahm; and/or

(3) Medibank has told you (or a person you represent) that your information was accessed or published in the data breach.

Registration is free. You do not need to pay anything to register for, or participate in the potential legal action.

Update: OAIC announces investigation of Medibank data breach

On 1 December 2022, the OAIC announced that it had commenced an investigation into the Medibank data breach. The OAIC’s investigation will focus on whether Medibank took reasonable steps to protect the personal information they held from misuse, interference, loss, unauthorised access, modification or disclosure. The investigation will also consider whether Medibank took reasonable steps to implement practices, procedures and systems to ensure compliance with the Australian Privacy Principles.

Resources

If you have been affected by the Medibank data breach, we encourage you to look at the following resources to help protect yourself:

If you are in immediate direct or imminent physical harm as a result of your information being compromised by the Medibank data breach, please call 000 and seek assistance.

If you have family or domestic violence related concerns about your personal safety or your personal information being misused, we encourage you to seek support from Services Australia.

Frequently asked questions

Maurice Blackburn has launched an investigation into potential claims against Medibank following the revelations of a wide-scale customer data breach, involving millions of current and former Medibank, ahm and international student account holders.

Medibank first confirmed the data breach in a statement on 13 October 2022, and have since revealed via a number of updates that the information that may have been exposed included customers’ names, dates of birth, phone numbers and email addresses, some Medicare card numbers, some passport numbers and health claim data (service provider name and location, where customers received certain medical services, and codes associated with diagnosis and procedures administered) some next of kin contact details for My Home Hospital patients and health provider details, including names, provider numbers and addresses.

On 18 November 2022, Maurice Blackburn lodged a representative privacy complaint with the OAIC.

On 1 December 2022, the OAIC announced that it had commenced an investigation into the Medibank data breach. After the OAIC investigation, if the Commissioner decides that Medibank failed to adequately protect its customers’ information, Medibank may be ordered to pay compensation to affected customers for the loss and damage they suffered as a result of the data breach, including for the distress and humiliation the data breach has caused them.

You (or a person you represent) are a current or former Medibank, ahm or international student customer;
You (or a person you represent) are a potential health insurance customer who requested a quote with ahm; and/or
Medibank has told you (or a person you represent) that your information was accessed or published in the data breach.

In order to register, you will need to provide us with:

your name
a telephone number
email
and postal address

You will also need to tell us whether you (or a person you represent) is a current or former Medibank, ahm or international student customer, you requested a health insurance quote from ahm, and/or that Medibank has told you that your information was accessed or published in the data breach.

Yes. Former Medibank, ahm and international student customers are eligible to register.

No, at this stage there is no deadline for registering.

Yes. Anyone who is a current or former Medibank, ahm or international student customer, requested a health insurance quote from ahm, and/or has been notified by Medibank that their information was accessed or published in the data breach is eligible to register with Maurice Blackburn to receive updates about our investigation into potential claims (including a representative complaint lodged with the OAIC) and compensation which may be sought on your behalf.

Yes, ahm is part of Medibank.

Medibank has announced that ahm customer data has been affected by the data breach. On 9 January 2023, Medibank announced that potential health insurance customers who requested quotes with ahm have also been affected.

Yes, Medibank has announced international student customer data has also been affected by the data breach.

If Medibank has notified you that your personal information (or the personal information of someone you represent) has been accessed or published in the data breach, you are eligible to register.

No.

At some stage later on, you may be asked to provide further information about your Medibank account, but at this stage, you don’t need to provide any documents or do anything to prove you are or were a Medibank, ahm or international student customer.

Maurice Blackburn is Australia’s leading class actions law firm with an unparalleled record of helping our clients secure the nations’ largest class actions recoveries, totalling over $3.7 billion since 1998.

Nothing.

Registering will not expose you to any out of pocket cost. Unless and until there is a successful outcome in any legal claim, all costs will be borne by Maurice Blackburn.

In the event of a successful outcome, any costs payable to Maurice Blackburn will be deducted from, and will not exceed, any compensation that you are entitled to receive.

Nothing. All costs will be borne by Maurice Blackburn.

Client confidentiality and privacy are very important to us. You can access our Privacy Policy here.

Contact the team

Email:
medibankdatabreach@mauriceblackburn.com.au

Phone:
1800 433 910

News

Australian leaders in class actions.

Get in touch

Our reputation for excellence in class actions is unparalleled, having recovered more than $4.2 billion for clients.

We are the only Australian class actions firm to deliver $100m+ settlements to clients in shareholder and listed securities actions, which we have done on ten occasions.

Lower cost to clients

Biggest recoveries

Most experienced

It doesn't cost you anything to know where you stand

1800 991 692