Medlab Pathology faces questions over data breach timeline

Medlab Pathology has joined Optus and Medibank in being formally investigated by the Office of the Australian Information Commissioner (OAIC) over a data breach.

The company disclosed a cyber incident in late October that had occurred at the start of 2022.

Breached data included pathology test results, credit card numbers with individuals’ names, and Medicare card numbers with individuals’ names.

The OAIC said in a statement that it would investigate Medlab’s protection of personal information and its compliance with Australian privacy principles.

The provider could face civil penalties of up to $2.2 million per contravention, if the OAIC determined it had sufficient evidence to file federal court proceedings.

Australian information commissioner and privacy commissioner Angelene Falk indicated that the time between the initial intrusion and notification that a breach had taken place is an area of interest to investigators.

“As the risk of serious harm to individuals can increase over time, a key focus for the OAIC is the time taken by entities to identify, assess and notify the office and affected individuals of data breaches,” Falk said in a statement.

“Organisations must also be proactive in minimising the risk of data breaches by putting in place reasonable security steps.”