After last month announcing it was commencing a class action against Optus, Aussie law firm Slater and Gordon is doing the same with Medibank, following its data breach.
In October, Medibank went public with news that it suffered a cyber incident. Turns out it was a lot worse than Medibank first thought, with the data on 9.7 million customers caught up in the massive breach.
On Friday, Slater and Gordon announced it had issued proceedings against Medibank on behalf of former, existing, and prospective customers “whose highly sensitive personal information was compromised and published on the internet”. Specifically, the claim extends to customers of Medibank’s subsidiary Australian Health Management (ahm) as well as customers of Medibank’s travel insurance products. Slater and Gordon said impacted children whose information was affected are also in the class, as are authorised representatives and providers.
The statement of claim, lodged in the Federal Court of Australia, alleges that Medibank and ahm breached privacy and consumer laws as well as legislation that governs customer data retention and data protection for private insurers operating in Australia.
In a statement, the law firm alleges that Medibank and ahm failed to protect or take reasonable steps to protect customers’ personal information from unauthorised access or disclosure and that the organisation failed to destroy or de-identify former customers’ personal information. The class action also alleges that Medibank failed to comply with legal obligations in collecting, using, storing, and disclosing customer information.
The class action also alleges that Medibank breached its contractual obligations to customers to whom it assured it had “adequate and appropriate security controls in place” to protect their information.
Law firms Maurice Blackburn Lawyers, Bannister Law Class Actions, and Centennial Lawyers in January joined forces to run legal action against Medibank, with reports noting at the time that the law firms had been investigating compensation claims and said they had registered tens of thousands of Medibank customers.
According to the ABC, the law firms are seeking compensation for Medibank and ahm health insurance customers who had their names, emails, mental health information, and other data leaked.
Slater and Gordon class action members are seeking compensation from Medibank for losses the data breach caused, including time and money spent replacing identity documents in addition to other measures to protect their privacy and prevent the increased likelihood of them falling victim to scams and identity theft. They are also seeking damages for non-economic losses such as distress, frustration, and disappointment.