Background

On 13 October 2022, Medibank issued an ASX release disclosing a “cyber incident” (the Breach).

Subsequent releases over October and November disclosed that the personal data of approximately 9.7 million current and former customers and the health claims data of approximately 480,000 customers was taken in the Breach. The hackers have since made personal and health claims data available on the dark web.

From market close on 19 October 2022 when Medibank went into a trading halt, to 26 October 2022 when the suspension was lifted, Medibank’s share price dropped more than 18% after details of the Breach were released.

Allegations

The class action alleges that Medibank breached its continuous disclosure obligations and engaged in misleading or deceptive conduct in relation to the adequacy of its privacy and information security protections. It is separate to the privacy litigation brought by Medibank customers whose personal and health information was accessed in the data breach.

The class action alleges that investors who acquired Medibank shares during the Claim Period are entitled to compensation for loss and damage as they paid more for those shares than they would have paid as a consequence of Medibank’s conduct. The class action also alleges that some group members would not have purchased Medibank shares if Medibank had complied with its obligations.

Class Action Information and Registration

Current and former investors who acquired an interest in Medibank shares between 10 September 2020 and 25 October 2022 inclusive are invited to register their participation in the class action or request further information by emailing medibankshareholders@phifinneymcdonald.com.