The Breach Notice Arrived: What You Owe, What You're Owed

TL;DR - A data breach notification is a legal event with a clock on it, not an apology email. Australian law tells you exactly what you owe in the first month: an assessment inside 30 days, a notification to the OAIC and affected people, and a duty to not make it worse. What the law is quiet about is what anybody owes you, because the compensation story runs through class actions that take years and pay out late or never. A reader email about an American "what to do after a data breach" guide sent me digging for the Australian version of that advice, and the honest answer is that most of it doesn't exist in one place. What you need to do: run the seven-day checklist below when a notice lands, understand what the Optus and Medibank class actions actually promise (no cheques yet, and for Medibank no claim form even exists), and brief your people before the second-wave scam emails arrive, because class action publicity is now a phishing trigger.

By The Numbers

I got an outreach email last week from a class action advocacy group. They wanted me to link to their guide on what to do after a personal data breach. I'm not linking to it, for reasons that boil down to it being link-building outreach from a lead-generation site. But the email bugged me in a useful way.

The guide itself is fine, in the way a checklist laminated to a wall is fine. Change your passwords, watch your statements, freeze your credit. Then it gets to the part that caught me: "explore your legal options, including joining a class action lawsuit." In America that paragraph writes itself. There's a claim form, a settlement administrator, a cheque. In Australia, that paragraph is where the good advice stops and the silence starts. Try to find a straight answer on what you're actually owed after an Australian data breach, and you'll find law firm registration pages, aggregators guessing at payout figures, and very little in between.

If you look after IT or security for an Australian business, this matters twice. Your company can be the one sending the breach notice, in which case the Notifiable Data Breaches scheme has a clock running against you from the moment you form a suspicion. Or your company can be on the receiving end, a customer of a breached vendor, in which case you need to know what the legal system will and won't do for your staff and your family. Both roles are in this post, because I've been in both.

Let me walk you through what the law actually requires, what the lawsuits actually offer, and what to do in the first week. Some of it surprised me.

What the notice actually tells you

Under the Notifiable Data Breaches scheme, an organisation covered by the Privacy Act that suspects an eligible data breach has 30 days to assess it. If the breach is likely to result in serious harm to any individual whose information is involved, the organisation must notify the OAIC and every affected individual "as soon as practicable." The notification has to say what happened, what information was involved, what the organisation is doing in response, and what the affected person can do about it.

That last clause is where most notices go soft. "We recommend remaining vigilant" is not a step. A notice that tells you the specific data classes (password hashes, licence numbers, health claims), the specific window, and the specific protections on offer (credit bans, replacement documents, a real contact) is a notice worth the pixels. One like that signals the organisation did the assessment work. One that reads like a public apology with a legal footer signals the opposite.

Here's what no notice can tell you, though, and it's worth being honest about it with your staff: whether their record was the one accessed. Breach notifications describe populations. A company with 400 employees at a breached vendor gets one letter that covers all of them, and the letter cannot say whether any individual's row in the database was touched, viewed, or copied. Treat "you may have been affected" as "assume you were affected" and act accordingly. The Frontier Airlines post I wrote in July makes the same point from the other side: the absence of a notice is not evidence that your data wasn't in the breach, because there's no obligation to email every person whose data was on file.

There's also a timing problem. The notice arrives when the breached organisation finishes its assessment, not when the attacker finished copying data. The gap between those two events is where the second-wave scams live, and we'll get to that.

The first seven days

When a notice lands, either because your own systems leaked or a vendor's did, the first week looks the same. This is the checklist I run, in order.

Day 1. Preserve before you respond. Freeze the logs, snapshots and message threads that show what happened and when. The instinct to patch, rebuild and move on destroys the evidence that the OAIC assessment, your insurer and possibly a court will all want later. If your systems were the breach, this is also the moment to write down who knew what and when, because the 30-day assessment clock started at first suspicion, not when you finished reading this post.

Day 2. Classify the data, not the incident. "We had an incident" is not a data class. Write down exactly which categories were exposed: credentials, identity documents, financial data, health data. The Privacy Act (APP 11) requires reasonable steps to protect personal information, and the NDB assessment turns on serious harm, which turns on what the data actually is. Licence numbers plus dates of birth is a different risk weight than a list of marketing emails. This classification is also what your notification has to contain, so you're writing it once, not twice.

Day 3. Draft the OAIC-ready timeline. Statement of facts with dates: detection, containment, assessment start, decision. If your breach is ever reviewed, the document they ask for first is this one. Keep it plain and keep it dated.

Day 4. Write the notification people can act on. What happened, which data, what we did, what you should do, by when, and a real contact. Drop "we take security seriously" from the draft entirely; nobody has ever been reassured by it, and it spends words you need for the actual steps. If identity documents were exposed, say so plainly and point people at credit bans, which are free and which most people have never heard of. The family-facing version of those steps is in the companion post to this one.

Day 5. Trigger the outside help. Cyber insurer (before any remediation costs are committed, or you may void cover), lawyer if the data classes are serious, and your vendor's incident contact if the breach came through one. The EY ticket-platform breach last July is the reminder that your data leaks through your vendors' doors, so the "am I the customer or the source?" question is worth answering explicitly in writing.

Day 6. Offer credit bans and document guidance. This is the single most useful thing a breached organisation can do for its people and the step most skip. A credit report ban is free, takes minutes, and stops new credit being opened in a person's name for the ban period. Point people at IDCARE (1800 595 160), the national identity support service, which walks individuals through the process.

Day 7. Brief the humans before the scammers do. Every breach notification is followed by phishing that uses the breach as its hook: fake "claim your compensation" portals, fake support calls, fake password reset links timed to the real one. Tell your staff the real notification channel, in advance, and tell them the window is 90 days, not one news cycle. The details differ by breach but the pattern holds; the Swiss government SharePoint breach post covers the same second-wave problem from the defender side.

None of this is exciting. All of it is what the law is actually asking for, and the whole list fits inside a week.

The legal paragraph, Australian edition

Now the part that guide hand-waves. What is the Australian legal system actually going to do about a data breach, and what of it reaches you?

There are three tracks, and they pay different people.

Track one: regulator penalties. The OAIC can bring civil penalty proceedings for serious or repeated interferences with privacy. It did exactly that against Optus in August 2025 over the 2022 breach, and it has separate penalty proceedings against Medibank. The maximum penalty is the greater of AU$50 million, three times the benefit gained, or 30% of adjusted turnover. Understand clearly what that money is: it's a penalty paid to the Commonwealth. It is enforcement, not compensation. If the OAIC extracts the full whack from a breached company, nobody in the affected population gets a cent of it. What a penalty does do is raise the price of bad security for the next company, which is worth something, just not to your wallet.

Track two: individual remedies. A person who suffers loss because of an organisation's breach of the Privacy Act can seek compensation, including through an OAIC determination or a civil claim. This is real but narrow in practice: you need to show actual loss or damage, which in most breaches means document replacement costs, time spent, or direct financial loss. Compensation for distress alone, with no financial loss, is genuinely unsettled Australian law. That's not me being cautious, that's the state of the case law the Medibank class action is actively testing.

Track three: class actions. This is the track people mean when they say "I'm owed money," so it's worth knowing exactly where the two big ones stand.

The Optus class action, run by Slater and Gordon in the Federal Court, was set down for trial on 7 June 2027, with all parties including the regulators ordered to a second mediation by 12 February 2027 (the first, in May 2025, settled nothing). Almost every current and former Optus customer is in the group. The Medibank class action, run by Slater and Gordon and Baker McKenzie as a single consolidated proceeding, is deeper in the weeds: as of March 2026 the parties were still fighting over whether Medibank had to hand over post-breach reports prepared by Deloitte, and Medibank lost that argument. When a case is arguing about discovery documents, it is years from a payout; the realistic earliest settlement window that informed observers talk about is 2028.

Two things about the current state that I wish more people knew:

There is no Medibank claim form. There is no Medibank settlement deadline. If you see a website or an email asking you to lodge a Medibank claim by a deadline, it is not the class action, and it is very likely a scam.

And there is no Optus settlement either, despite comparison sites publishing "estimated payout" figures that read like promises. Nothing has been agreed, nothing has been approved by a court, and nobody knows what an Optus payout would look like. Registration with a law firm running a class action in Australia is free; open (opt-out) class actions automatically include everyone in the group unless you opt out, so the practical action for most affected people is to keep records of their costs and register for updates, not to fill in claim forms that don't exist.

For an IT decision-maker, the track that matters most is track one, because it's the one changing behaviour. Every additional million in penalties is a line item in somebody's business case for fixing the access review they've deferred three quarters running. Compliance is theatre until a breach forces it to be real, and the penalty regime is what forces it.

Whether to say anything about the lawsuit

If your organisation is the one breached, my advice on mentioning class actions in your own communications is simple: don't speculate, and don't editorialise about litigation risk in the breach notification itself. State the facts, the steps, the contacts. If affected people ask about legal options, answer factually (registration is free, open class actions include everyone by default) and leave the advice to the firms.

If you're on the receiving end, as a customer or via a vendor, the calculus is different. Your staff will see "Optus class action" headlines and wonder if there's a form to fill in. The genuinely useful brief is one paragraph: the actions are years out, no payout is certain, claims are free to join and automatic under opt-out rules, and anything asking for payment or urgent personal information is a scam. The legal system will take years to produce whatever it produces; the credit ban takes ten minutes and protects them this month. Prioritise accordingly.

The second wave

Every major data breach now produces a second, artificial breach: scammers using the publicity as their hook. Class action news is the newest version.

The pattern is old and reliable. Real breach, real headlines, then phishing emails that borrow the headlines: "settlement claim portal," "compensation registration," "verify your details to receive your payment." The Optus and Medibank cases are perfect raw material because millions of people know they were affected, nobody knows the status, and a fake email promising clarity lands in an information vacuum.

Defend against it the boring way. The real law firms publish everything on their own domains, and the OAIC publishes penalty proceedings on oaic.gov.au. No genuine class action registration requires a fee, your tax file number, or a scan of your passport. And the window matters: breach-themed contact runs hot for about 90 days after a notification, so "I haven't seen a scam about it in a fortnight" proves nothing.

What you should do right now

These are the short jobs, in order. Most are under an hour.

1. Check whether you have an NDB obligation at all. If annual turnover is AU$3M or more, or you handle health information, credit reporting data or TFNs, the scheme applies to you regardless of size. Read the OAIC's own two-page summary, not a blog (including this one).
2. Write the seven-day checklist into your incident response plan now, while nothing is on fire. Day 1 through Day 7 from this post is a starting skeleton; adapt it to your systems.
3. Pre-draft the notification skeleton. The sections are known in advance: what happened, which data, what we did, what you should do, who to contact. Filling in a skeleton at 9pm on a Sunday beats composing one.
4. Add credit-ban guidance to your breach runbook, with the IDCARE number (1800 595 160) and the three credit reporting bodies in it. It is the highest-value paragraph most breach notices never include.
5. If your people were in a past breach (Optus, Medibank, anything), check whether they've done a credit ban. Most haven't. The 21-day initial ban extends to 12 months for people with a genuine fraud concern, and it's free.
6. Brief staff on the fake-claim pattern before the next headline breach, not after. Real claims never charge a fee and never need your TFN over email.
7. Keep cost records if you're in an affected group. Replacement documents, time, direct losses. Whatever the Optus or Medibank proceedings eventually produce, the people who documented their losses at the time will be the people who get paid.

Key Takeaways

• A breach notice is a legal event with a 30-day assessment clock, not an apology email. The NDB scheme tells you what you owe: assessment, notification, real steps.
• What the law is quiet about is what anybody owes you. In Australia the compensation story runs through narrow individual remedies and class actions that take years.
• Penalties and compensation are different money. OAIC civil penalties go to the Commonwealth. They change industry behaviour; they don't pay your document replacement costs.
• Optus is headed for trial on 7 June 2027 with a mediation due by February. Medibank is still in discovery and there is no claim form, no settlement and no deadline.
• The most useful protection is free and takes ten minutes: a credit report ban, 21 days initially, extendable to 12 months, via the three credit reporting bodies.
• Class action publicity is a phishing trigger. Brief people on the fake-claim pattern inside a 90-day window, before the scammers write to them first.

FAQ

Do I have to notify the OAIC and individuals separately? Yes. Under the NDB scheme, an eligible data breach means notifying both the OAIC and every affected individual, as soon as practicable after you conclude the breach is likely to result in serious harm. The 30-day assessment window starts when you first suspect a breach, not when you finish investigating.

What compensation can an individual actually claim after a data breach in Australia? Losses you can document: replacing identity documents, direct financial loss, and in some cases time spent. Compensation for distress without financial loss is unsettled law, which is precisely the ground the Medibank class action is testing. Nobody should promise an individual a payout today, because none exists yet.

Is the Medibank class action settled? How do I claim? No, and there's nothing to claim yet. The consolidated proceeding is still in interlocutory stages; as recently as March 2026 the parties were fighting over discovery documents. There is no official claim form. Any site or email asking you to lodge a Medibank claim by a deadline is not the class action.

What is a credit report ban and how long does it last? A request to the credit reporting bodies that stops your credit information being disclosed for credit checks. The initial ban runs 21 days from your request and can be extended by up to 12 months if you've been, or are likely to be, a victim of fraud. Extensions generally want a police or ReportCyber reference number. IDCARE (1800 595 160) helps people through it for free.

We're an SMB under the turnover threshold. Does the NDB scheme apply to us? Possibly yes anyway. The turnover carve-out doesn't apply if you handle health information, credit reporting information or TFNs, or if you're an employee association or a trading in personal information business. Check the OAIC guidance rather than assuming.

Does getting a breach notification mean my data was definitely stolen? No, and the reverse also holds: not getting one doesn't mean it wasn't. Notifications describe populations, not individuals. The safe posture after any relevant notice is to act as if your record was in the affected set.

My Take

The thing I keep coming back to is how much of the Australian advice gap is a paperwork gap. That outreach group's guide works because the American system has settlement administrators and claim forms, machinery that turns a breach into a cheque eventually. Our system's machinery is mostly the OAIC's penalty power, which is genuinely getting stronger, and a class action regime that moves at the speed of a glacier with good lawyers. That's not automatically bad; penalty regimes might deter breaches better than cheques do. But it leaves the individual holding a notice, a to-do list, and a decade-long wait, and almost nobody writes down the to-do list for them.

What I'd like the industry to normalise is the credit ban offer in every serious breach notification. It's the one action that meaningfully protects a person this month, it's free, it takes minutes, and it's the step most notices skip in favour of "remain vigilant." If you run IT anywhere, you can fix that in your own runbook this week without waiting for the law to change.

And the honest expectation-setter: the Optus trial is a year out and Medibank is further. Whatever those cases produce, the people who kept their cost records and did their credit bans in month one will be better off than the people who spent month one reading settlement rumour sites. The to-do list beats the lawsuit. It beats it every time.

Mathew Clark Founder, SecureInSeconds Currently: drafting the breach runbook paragraph I wish three vendors had sent me Drafted with AI assistance - read, verified, and fixed by a human.

Further Reading

• OAIC: Notifiable Data Breaches scheme overview - the regulator's own explanation of the 30-day assessment and notification duties
• Australian Information Commissioner takes civil penalty action against Optus (OAIC, August 2025)
• Slater and Gordon: Optus data breach class action - trial date, mediation orders and group membership
• IDCARE: Credit bans in Australia - the free 21-day ban, extensions, and the 1800 595 160 support line
• Privacy Act 1988 (Cth) - the Act behind the ban periods, the NDB scheme and APP 11
• Equifax: credit report bans and extensions
• Your vendor's helpdesk is now a breach vector - how a breach reaches you through a vendor's support tool
• You got a breach email - what you're actually owed - the family-facing companion to this post