Following the opening of an inquiry into its management of personal information, the Office of the Australian Information Commissioner (OAIC) has raised the possibility of financial penalties for Medibank’s data breach.
The OAIC declared that the focus of their examination will be “whether Medibank took reasonable precautions to secure the personal information they had against misuse, interference, loss, unauthorised access, modification, or disclosure.”
According to a statement from the agency, “the investigation will also take into account whether Medibank took reasonable steps to develop methods, procedures, and systems to guarantee compliance with the Australian Privacy Principles (APPs).”
If a negative finding is made, Medibank might be subject to fines of up to $2.2 million for each infraction.
The beginning of the probe was timed to the attackers’ alleged dump of all remaining data.
Victims of the data leak are being supported in various ways by Medibank.