Medibank Data Breach Class Action: Is There a Payout Date?
No. There is no settlement, no claim form, and no payout figure. The case is still being fought in the Federal Court — as recently as March 2026 the parties were arguing over document production.
Active litigation. No settlement, no claims process, no payout date.
| Status | Active litigation — not settled |
|---|---|
| Court | Federal Court of Australia |
| Firms | Slater and Gordon; Baker McKenzie (consolidated) |
| Consolidation order | 1 August 2023 |
| Funder | Omni Bridgeway (no win, no pay) |
| People affected | Approximately 9.7 million current and former Medibank, ahm and international student customers |
| Breach date | October 2022 |
| Claim form | Does not exist |
| Payout date | None. Realistically 2028 or later, and only if the case settles or succeeds. |
There is no settlement, no claims process, no deadline and no compensation amount. The class action is still being fought in the Federal Court of Australia, and the parties were litigating document production as recently as March 2026.
What happened
In October 2022, Medibank suffered a cyber incident exposing the personal and health information of roughly 9.7 million current and former customers — one of the largest health data breaches in Australian history. Some of the stolen data, including sensitive medical information, was subsequently published by the attackers.
Where the case actually stands
The consumer class action. Slater and Gordon and Baker McKenzie each filed proceedings; the Federal Court approved their consolidation into a single proceeding on 1 August 2023. It is funded by Omni Bridgeway on a no-win-no-pay basis.
The case is in contested interlocutory litigation, not settlement. As recently as March 2026, Medibank was refused leave to appeal a ruling concerning reports prepared by Deloitte after the cyber incident; the Court ordered those reports produced to the applicants under a confidentiality regime. Medibank had resisted production on legal professional privilege grounds. That fight tells you exactly how far this is from resolution — parties argue about privilege over investigation reports in the discovery phase, which comes long before trial and much longer before any settlement.
A separate OAIC proceeding. The Office of the Australian Information Commissioner has brought civil penalty proceedings against Medibank under the Privacy Act. Understand this clearly: any penalty imposed in that case goes to the Commonwealth, not to affected customers. It is enforcement, not compensation. A large penalty would not put money in your pocket, though it would strengthen the factual record underlying the class action.
Realistic timeline
Where the case is now — discovery, with privilege disputes still being appealed — puts a first payment at 2028 at the earliest, assuming it settles. If it runs to trial and any appeal, later.
Australian data breach class actions are also genuinely difficult. There is no free-standing statutory right to compensation for a privacy breach in Australia comparable to the UK position, and the assessment of damages for distress without financial loss is unsettled law. The case is important precisely because it is testing that ground. It is not a formality.
What to do now
Register your interest. Registration is free and does not commit you to anything. It is how you get told when something happens — and registration cut-offs in Australian class actions are firm.
Preserve evidence of harm. This is the step that will matter most to your individual entitlement, and almost nobody does it. If the breach caused you real detriment, document it now while it is documentable:
- ✓Records of identity theft, fraudulent accounts, or attempted fraud against you.
- ✓Costs you incurred — replacing identity documents, credit monitoring, credit report fees.
- ✓Medical or psychological treatment relating to distress, with dates.
- ✓Correspondence with Medibank, banks, or the police.
Protect yourself practically. Independent of any litigation: place a credit ban with the Australian credit bureaus (Equifax, Experian, illion), and be alert to targeted scams — the published data has been in circulation for years and is used in convincing impersonation attempts.
Do not pay anyone. No legitimate service charges to register you for this class action, and there is nothing to buy.
Frequently Asked Questions
What is the Medibank data breach payout date?
There isn't one. No settlement exists. Any site showing a deadline or payout figure for a Medibank settlement is publishing something that is not true.
How much will I get?
Unknowable. No settlement, no judgment, and no established Australian benchmark for data breach compensation at this scale. Comparable overseas settlements have ranged from tens of dollars for distress-only claims to substantially more for documented identity theft — but Australian law on this is genuinely unsettled.
Is it too late to join?
No. Australian class actions are opt-out — if you fit the group definition you are already a group member. Registering is still worthwhile so you receive notices directly.
Does the OAIC case pay me anything?
No. Civil penalties are paid to the Commonwealth. Compensation, if any, comes through the class action or the representative complaint.
I was an ahm or international student policyholder, not Medibank branded.
The breach covered current and former Medibank, ahm, and international student customers. Check the group definition on the law firm's registration page.
Medibank says my data wasn't in the leaked set. Am I affected?
The class group definition governs, not the leak publication. Different categories of data were taken for different customers, and the group definition may be broader than the set of published records.
See every settlement you qualify for
Tell SettleScout which brands you use and it matches you with open settlements, estimates your payouts, and reminds you before every deadline.
Free to download. Premium plans available.