In June 2024, the Office of the Australian Information Commission(OAIC) filed civil penalty proceedings in the Federal Court against Medibank in relation to the data breach, and alleges that from March 2021 to October 2022, Medibank "seriously interfered with the privacy of 9.7 million Australians by failing to take reasonable steps to protect their personal information from misuse and unauthorised access or disclosure". As of October 2024, the case is ongoing.