Why did Medibank Private (ASX:MPL) lose its latest Federal Court bid?

The full Federal Court dismissed Medibank’s application for leave to appeal a ruling regarding legal professional privilege. The court determined that three internal reports prepared by Deloitte following the 2022 cyberattack are not protected by privilege.

What are the Deloitte reports and why do they matter to investors?

The documents consist of three reports commissioned by Medibank (ASX:MPL) immediately following its major 2022 cybercrime event. These reports likely contain detailed technical findings regarding the company's security failings and internal responses.

How does this court ruling affect the Medibank (ASX:MPL) consumer class action?

This ruling is a major tactical setback for Medibank's legal defence as it removes a primary barrier to evidence discovery. By gaining access to the Deloitte reports, the class action applicants can now scrutinise Medibank’s internal post-incident investigations.

Is the disclosure of these cyberattack reports public?

No, the documents will not be released to the general public or the media immediately. The Federal Court ordered that the reports be produced to the class action applicants under an "agreed confidentiality regime."

What is the background of the Medibank (ASX:MPL) 2022 cybercrime event?

In late 2022, Medibank Private (ASX:MPL) suffered a massive data breach where hackers accessed the personal and health claim data of approximately 9.7 million current and former customers. This event led to significant reputational damage, regulatory scrutiny, and the subsequent consumer class action.

Does this ruling change the investment thesis for Medibank (ASX:MPL)?

The ruling shifts the risk profile of the stock toward the "bear" case by increasing the likelihood of a significant legal payout or settlement. While Medibank maintains a strong market position in private health insurance, the persistent "tail risk" of class action litigation remains a drag on the share price.

What are the main risks for Medibank (ASX:MPL) shareholders following this news?

The primary risk is a potential increase in the "provisions for litigation" on Medibank’s balance sheet if the reports reveal significant culpability. There is also a secondary risk of further reputational damage if specific details of security negligence are leaked or discussed during court hearings.

How might this affect the Medibank (ASX:MPL) share price in the short term?

The market generally dislikes legal uncertainty, so the failure to protect these documents may cause short-term volatility or downward pressure on the ASX:MPL ticker. Traders often view a loss of legal privilege as a sign that the "shield" around a company is weakening.

Image for illustrative purposes only. Not a real photo.

Medibank fails to shield cyberattack reports from court

Written by Isaac FrancisPublished Mar 23, 2026, 12:30 AMLast Updated Jul 3, 2026, 10:10 AM

The full Federal Court has dismissed Medibank Private's (ASX:MPL) attempt to shield internal documents from a major consumer class action, marks a significant blow to the insurer's legal strategy.

In a ruling handed down on March 23, the court refused Medibank leave to appeal a previous decision which stripped legal professional privilege from three Deloitte reports commissioned following the 2022 cybercrime event.

The outcome upholds a March 2025 ruling, effectively forcing the insurer to hand over the sensitive findings to lead applicants.

While the documents will be released under a strictly agreed confidentiality regime, the forced disclosure remains a pivotal development for the thousands of customers seeking accountability over the massive data breach.

Medibank fails to shield cyberattack reports from court

Frequently asked questions

Assets related to this article