TL;DR - A data breach email is a legal document with a fancy apology attached. Australian law says the company owes you a notification and nothing much else, and the compensation you hear about on the news is years away or never. The good news is the most useful protection costs nothing and takes about ten minutes: a free ban on your credit report that stops crooks opening loans in your name. What you need to do: read the email properly with the guide below, put the free credit ban on, save it somewhere you'll find it, and know that the "claim your compensation" emails that follow a breach are always scams.
An email landed last week from an American group that runs class action websites, with a guide about what to do after your data gets leaked. It's a guide built for their system, where breaches eventually turn into claim forms and settlement cheques. Australian families get told the same story every time there's a headline: there'll be a class action, you'll get compensation. I wanted to check what the Australian version of that promise actually looks like.
What I found surprised me, and it changed what I'd tell my own family. If you've ever had your details in a breach (Optus, Medibank, and plenty since), this is the letter I wish came attached to every breach email.
First, what that email actually is
When a company holding your personal information gets hacked, Australian law says they have to work out how bad it is within 30 days. If your information was exposed and it could seriously harm you, they have to tell you and the regulator. That's the email. It has to say what happened, what of yours was in it, what they're doing, and what you can do.
Some of these emails are good. They say exactly what was taken (a licence number is different to an old email address), exactly when, and exactly what to do. Some are hopeless: two paragraphs of "we take your privacy seriously" and a phone number. The good email tells you the writer did their homework. The hopeless one tells you to do yours.
One thing no breach email can tell you: whether your record, specifically, was looked at. The company usually doesn't know either. So the safe move is to treat the email as if it said "your details were taken", even where it politely says "may have been".
The honest answer on compensation
Here's the part nobody puts plainly, so I will.
If an Australian company loses your data, the law does not automatically owe you money. What the law owes you is the notification, and a regulator (the OAIC) who can fine the company if they were careless. Those fines can be enormous, up to $50 million. But fines go to the government. Not one dollar of a fine lands in your pocket.
What about the class actions on the news? Those are real, and I looked up the two biggest:
Optus (the 2022 breach, close to 10 million people): the class action goes to trial in June 2027. There's a court-ordered mediation in February 2027, which is the first chance a settlement could happen. Nothing has been agreed. Anyone showing you an "estimated payout" for Optus is guessing.
Medibank (the 2022 breach, about 9.7 million people): nowhere near finished. In March 2026 the lawyers were still arguing over which documents have to be handed over. People familiar with the case talk about 2028 at the earliest for any money, and only if it settles. And here's the fact I find most useful: there is no Medibank claim form. It doesn't exist. The case hasn't settled, so there's nothing to claim.
If an email or website asks you to lodge a Medibank claim before a deadline, it is not the class action. It is a scam. Full stop.
Signing up with a law firm running one of these cases is free, and for most big cases you're automatically included whether you sign up or not. So the smart move isn't racing to fill in forms. It's this: keep a note of what the breach costs you (replacing a licence, time off work to sort it out) and keep it somewhere you'll find it in 2028. The people who kept receipts are the people who get paid.
The ten minutes that actually protects you
While the lawsuits crawl along, there's one free move that protects your family right now: a credit report ban.
Plain English: before a bank lends money in your name, they check your file with a credit reporting company. Australia has three of them (Equifax, Experian and illion). A ban tells all three "don't show my file to anyone". No file, no loan. If a crook has your licence number from a breach and tries to open a phone plan or a loan in your name, the ban is what stops them.
- It's free.
- It lasts 21 days to start. If you've had your details in a breach (you have, that's why you're reading this), you can extend it for up to 12 months, and keep extending.
- Requesting it with one agency is enough if you tick the box asking them to tell the others, but doing all three yourself is the safest.
- IDCARE can walk you through it: 1800 595 160, Australia's free identity help service. Save that number now, before you need it.
To extend past 21 days you may need a reference number from police (ReportCyber) or a breach notification, which is another good reason to save that breach email and not archive it into the void.
This is the step the American guide skips past and the step most breach emails never mention. It's the one that matters this month, not in 2028.
The scam that follows every breach
Here's the part that makes me want every family to read this. Every big breach is followed by a second, fake one.
Crooks know millions of people just got a scary email and half-remembered news about compensation. So they send an email that says "Medibank settlement - claim your compensation now" or "Optus class action - register before Friday", with an official-looking link. The link steals your details, or charges a "processing fee", or asks for your tax file number to "verify" you.
The rules that keep you safe are boring and reliable:
- Real class actions never charge you to join and never need your TFN or passport scan over email.
- There is no deadline to rush for a case that hasn't settled (and neither Optus nor Medibank has).
- Real information lives on the law firm's own website or oaic.gov.au, not in a link that arrived by email.
- These scams run hot for about three months after a breach makes the news. The absence of scams this week means nothing.
Slow down. Any email about money you're owed, from a company that lost your data, gets treated as fake until you check it yourself.
Your five-step plan when a breach email lands
- Save the email in a folder you'll find. Search "breach" and make a folder. The date on that email is proof later.
- Read what they took, not what they're sorry about. Licence numbers, passports, Medicare cards and passwords mean action today. An old email address means lower-key action.
- Do the credit ban. Ten minutes, free, via Equifax, Experian and illion. Extend it at 21 days. Call IDCARE on 1800 595 160 if any step is confusing.
- Change the password on your email first, then anywhere you reused it. Your email is the master key to everything else. Turn on that app-based double-check (authenticator app) while you're there.
- Tell the family group chat. If your details leaked, your partner's and teenagers' habits matter too. "We never charge to join a class action" is a good house rule.
Key Takeaways
- A breach email is a legal notice, not an apology. The company owed you that email by law. What they owe after that is much thinner than most people think.
- Compensation in Australia is slow or never. Optus goes to trial in June 2027. Medibank has no settlement, no deadline, and no claim form at all.
- A $50M fine goes to the government, not to you. It might stop the next company being careless, but it won't replace your licence fee.
- The credit report ban is the real protection. Free, ten minutes, 21 days initially, extendable to 12 months. IDCARE: 1800 595 160.
- "Claim your compensation" emails are always fake. Real claims never charge and never need your TFN.
- Keep receipts. Whatever the courts eventually decide, the people who documented their costs get paid first.
FAQ
I got a breach email but my partner didn't. Does that mean I was affected and they weren't? Not reliably either way. Companies email what they can identify, and their records aren't perfect. The safe move is the same for both of you: read what data was involved and do the credit ban.
Is the Optus payout happening? I saw a figure online. No payout has been agreed. The case goes to trial in June 2027 with a mediation in February 2027 before that. Any "estimated payout" figure you see online is a guess on a comparison website, not a promise from a court.
How do I actually join the Medibank class action? You don't need to do anything to be part of most big Australian class actions; they cover everyone affected automatically unless you opt out. Registering with the law firm gets you email updates. What doesn't exist is a claim form or a deadline, because there's no settlement yet. Anyone who says otherwise is scamming you.
What's the difference between a credit ban and a credit freeze? In Australia the official term is a ban period (some people say freeze - same thing). It stops the credit reporting companies showing your file, which stops new credit in your name. It's free under the Privacy Act.
Do I need a police report to extend the ban? Usually yes for extensions - a ReportCyber reference number or similar. That's exactly why you saved the breach email in step one: it's your evidence you were in an affected group.
The breach email has a link to a "support portal". Should I click it? Better not. If you want the company's real information, type their website address yourself or find their number independently. A breach email you genuinely received can be read safely; links inside any email about money or verification are where the second-wave scams live.
My Take
The American guide my reader sent me isn't wrong, it's just wrong for here. Their system eventually cuts cheques. Ours mostly fines companies and litigates for years. I used to think that meant Australian breach victims just miss out. Writing this changed my mind a bit: the cheque was always a bad reason to feel safe. The ten-minute credit ban protects your family this month in a way no lawsuit ever will, and it's sitting there free while everyone waits for news about a settlement.
So here's my pitch for the family group chat: skip the payout rumours, do the ban, save the email, and warn Nan about the "compensation" texts before they arrive. The lawsuit will take care of itself, slowly, with or without you. Your credit file is the thing you can actually look after today.
Mathew Clark Founder, SecureInSeconds Currently: the only person in the house excited about a 21-day credit ban Drafted with AI assistance - read, verified, and fixed by a human.
Further Reading
- IDCARE: Credit bans in Australia - the free ban explained, plus the 1800 595 160 helpline
- OAIC: Fraud and your credit report - the regulator's own ban explainer
- Slater and Gordon: Optus class action - trial and mediation dates, straight from the firm running it
- Equifax: placing and extending a ban
- How to spot a scam text before you click
- Why scammers already know your information
- In a data breach? The 4 things to do in the next 24 hours
- The business version of this post - for the IT person in the family who got sent this
