Private health insurer Medibank faced dual legal and regulatory proceedings in Federal Court stemming from its 2022 cyber attack. The Australian Information Commissioner (OAIC) and class action litigators escalated civil penalty actions regarding the exposure of personal health records belonging to 9.7 million current and former customers. Proceedings allege Medibank failed to take reasonable steps to protect sensitive health data and maintain adequate IT security controls.