What compensation is being awarded by OAIC for privacy breaches?

Optus privacy breach

Federal Court of Australia proceedings commenced in April 2023.

Optus, a large telecommunications company was the subject of a cybersecurity attack during the period between 17 and 20 September 2022, which potentially affected the personal information of up to 9.5 million customers[ii].  The class action trail is scheduled for in 2027.

………………………………………………………………………………….

Medibank privacy breach

Multiple class actions were commenced in the Federal Court of Australia in relation to the cybersecurity breach, where a hacker gained access to the health insurer’s network in August 2022, via a personal computer of a contractor[iii].

The hack remained undetected for weeks and the hacker released personal data of customers onto the dark web when Medibank refused to pay a ransom.  The Medibank cybersecurity attack affected about 9.7 million people in Australia.  These actions have been consolidated. The trial has been scheduled for October 2027.

On 2 October 2026, Justice Beach heard arguments regarding whether the class action should be heard together the proceedings commenced by the Australian Information Commissioner against Medibank for the imposition of penalties for alleged privacy breaches.  Counsel for the class action applicant argued that the cases should be heard together given the overlap of technical issues in terms of the architecture of Medibank’s security systems and deficiencies in protecting client data[iv].

………………………………………………………………………………….

Department of Veteran Affairs (DVA) privacy breach

 In October 2026 Victorian Supreme Court proceedings were commenced  against the DVA on behalf of veterans, alleging “mass and routine sharing” of veterans’ medical records with the University of South Australia, without their knowledge or consent to the sharing. The claim seeks damages for privacy breach and breach of confidence.

About 300,000 veterans may have been affected by the alleged breach[v].

Latitude privacy breach

Latitude Financial Services, an Australian consumer finance provider had a cyberattack in March 2023 involving the theft of personal information of millions of its customers.

Court proceedings have not been commenced. A Representative Complaint was made to and accepted by the privacy regulator, OAIC, to investigate the privacy breach.

The OAIC is continuing its investigations and is still to make a determination in relation to the breach and whether class members are entitled to compensation[vi].

……………………………………………………………………………….

Qantas Data Breach

 A representative complaint was lodged with the OAIC against Qantas Airways Limited on 17 July 2025, alleging that Qantas did not have adequate systems to protect customer personal information.

On 16 July, 2026, the Australian Privacy Commissioner published a Report[vii] of the OAIC’s preliminary inquiries into the 2025 Qantas Airways Limited (Qantas) data breach incident which affected approximately 5 million Australians.  The breach occurred following a social engineering attack by hackers on an overseas third-party provider contracted by Qantas.

The OAIC’s investigations into the breach included clarification of the causes of the data breach, examining the security measures implemented by Qantas prior to the data breach, and scrutinising Qantas’s response to the data breach.  As a result, the OAIC concluded:-

–        that its “preliminary inquiries did not reveal any omissions or failings in the steps taken by Qantas to protect the personal information it held or to ensure the third-party contact centre provider it uses complied with the Privacy Act”; [viii]

–        that “the data breach occurred despite a range of security measures Qantas had in place to reduce the risk of a cyber attack”[ix].