Zoe Lee Mcclure v Medibank Private Ltd

McClure v Medibank Private Ltd (VID64/2023) is a Federal Court class action commenced on behalf of individuals whose personal information was compromised in the October 2022 Medibank data breach. The proceeding is brought under Part IVA of the Federal Court of Australia Act 1976, which allows one person to sue on behalf of a larger group of people who have suffered the same or similar loss. The class action seeks compensation for loss and damage suffered by affected individuals as a result of Medibank's alleged failure to protect their data.

Zoe Lee McClure is the lead applicant — the named individual who formally commenced the class action on behalf of all group members. In Australian Federal Court class actions, one person brings the case in their own name and on behalf of the broader group. The lead applicant does not receive any special benefit simply by being named — the proceeding is run in the interests of all group members. The case name VID64/2023 refers to the Victorian Registry of the Federal Court, proceeding number 64 of 2023.

The class action is brought on behalf of current and former Medibank Private, ahm, and international student customers whose personal information — including names, dates of birth, contact details, Medicare numbers, and in many cases sensitive health claims data — was accessed and/or exfiltrated by the threat actor in the October 2022 breach. If your data was among the approximately 9.7 million records compromised, you may be a group member in this proceeding.

The class action seeks compensation for loss and damage suffered by group members as a result of the data breach. This may include compensation for distress, anxiety, loss of time spent dealing with the breach's consequences, costs of protective measures, and losses flowing from any misuse of exposed data. The final form and quantum of any damages will be determined by the court or through a settlement process. No compensation has been awarded at this stage — the proceeding is ongoing.

The OAIC civil penalty proceedings are a regulatory action brought by the Office of the Australian Information Commissioner against Medibank in the Federal Court. The OAIC is a government body — it is not acting on behalf of individual customers. Any penalties awarded in the OAIC proceedings go to the Commonwealth, not to affected individuals. The McClure class action (VID64/2023) is a private civil proceeding brought directly on behalf of affected individuals seeking personal compensation. The two proceedings are legally distinct, run on separate tracks, and have different legal bases and potential outcomes.

The shareholder class action against Medibank is a separate proceeding brought on behalf of Medibank shareholders who allege the company made misleading statements or failed to properly disclose its cybersecurity risks before the breach became public. The McClure class action (VID64/2023) is brought on behalf of customers whose personal information was exposed — not shareholders. The two classes of claimants and the legal basis for each claim are entirely different.

The proceeding was filed in the Federal Court of Australia (Victorian Registry) in 2023. Preliminary case management steps have been underway. Significant interlocutory issues — including those relating to the Deloitte cybersecurity report commissioned by Medibank — have been the subject of contested proceedings. This is a complex class action and is expected to take a number of years to resolve, either through a court judgment or a negotiated settlement. This page will publish significant court steps and public outcomes as they occur.

Medibank commissioned an internal cybersecurity review by Deloitte after the breach. The Deloitte report has been a contested piece of evidence — Medibank sought to protect it from disclosure on privilege grounds. The Full Federal Court has been involved in resolving questions about access to and use of the Deloitte report. The outcome of those interlocutory steps matters because the report may shed light on what Medibank knew about its cybersecurity vulnerabilities and when it knew it — which is directly relevant to the class action's allegations.

Under Australian Federal Court class action procedure, affected individuals are generally included as group members automatically unless they opt out. You are not required to register or take any active step to be included at this stage. If a settlement is reached or the proceeding progresses, there will be formal notification steps and you may have the opportunity to register a claim. Following this matter on this platform ensures you receive public updates about key dates, notices, and steps that may require your action.

No. Following this matter is completely free. You will not be asked for payment details and you are under no obligation of any kind. Following this matter does not create a solicitor-client relationship and is not a legal retainer. It means you will receive public updates about significant developments in the class action proceedings as they occur.