This was published 3 years ago

Complaint lodged against Medibank with privacy watchdog

December 14, 2022 - 1.48am

A complaint against health insurer Medibank has been lodged with Australia's chief privacy body in a move that could see victims compensated.

Medibank has said it was notified late yesterday by legal firm Maurice Blackburn about a representative complaint the company had lodged with the Office of the Australian Information Commission (OAIC).

"Medibank has not yet been contacted by the OAIC in relation to the complaint," the health insurer said in a statement.

Medibank said it would continue to cooperate with the OAIC.. A Current Affair

"The complaint includes allegations that Medibank has breached the Australian Privacy Principles and seeks compensation for individuals whose personal information was exposed as a consequence of the cybercrime.

"Medibank continues to support its customers from the impact of this crime through our previously announced Cyber Response Support Program which includes mental health and wellbeing support, identity protection and financial hardship measures."

Medibank said it would continue to cooperate with the OAIC.

Last month, Australian Federal Police claimed hackers are Russian cybercriminals.

Thousands of customer details have been posted on the dark web since the hack.

Earlier this month an investigation into the data breach was launched.

It's looking at focus on whether Medibank took reasonable steps to protect the personal information they held from misuse, interference, loss, unauthorised access, modification or disclosure.

The investigation will also consider whether Medibank took reasonable steps to implement practices, procedures and systems to ensure compliance with the Australian Privacy Principles (APPs).

If the OAIC's investigation satisfies the Commissioner that an interference with the privacy of individuals has occurred, the Commissioner may make a determination that can include requiring Medibank to take steps to e, and to redress any loss or damage.

It faces fines of more than $2m for each contravention, plus could be ordered to ensure the act or practice is not repeated or continued.