In October 2025, the Federal Court ordered Australian Clinical Labs (ACL), one of Australia's largest pathology companies, to pay $5.8 million in civil penalties over a ransomware attack on its Medlab Pathology business. It was the first time any organisation had been fined under the Privacy Act 1988 (Cth), and the judgment is a warning for every business that collects or holds personal information. The surprising part is that ACL was not punished for being hacked. It was punished for what happened afterwards: an investigation too shallow to find the theft, and a notification to the regulator that came months too late.
What happened: the Medlab ransomware attack
ACL is one of Australia's biggest pathology companies and reported revenue of about $995.6 million in the financial year ending June 2022. In late 2021 it acquired the Medlab Pathology business, which operated in New South Wales and Queensland, and with it inherited Medlab's IT systems. In February 2022, a ransomware group known as Quantum attacked those systems. Within four hours of the first warning, files on computers in Brisbane and Sydney had been encrypted, and the attackers had also copied around 86 gigabytes of data before locking the systems (ABC News).
The sensitivity of what was taken is central to the case. The stolen data included roughly 128,608 Medicare numbers with names attached, 28,286 credit card numbers (more than 3,000 of them with the card's CVV code), and around 17,539 individual medical and health records linked to pathology tests. In total, more than 223,000 people were affected (OAIC).
How ACL responded is where the case turns. The Office of the Australian Information Commissioner (OAIC) later alleged that ACL had no dedicated cybersecurity team at the time of the attack. The response was led by an IT team leader with no formal cybersecurity qualifications, working from a ransomware playbook he had not been trained to use, and the OAIC alleged that critical steps in the playbook were not followed, including analysing the ransomware itself. ACL engaged external specialists, but the OAIC found that engagement was thin: the reviewers examined about one hour of firewall logs, ran dark web scans, and concluded there was no evidence that data had been taken (The Guardian). ACL closed the incident in March 2022 on that basis.
The picture changed over the following months. On 25 March 2022, the Australian Cyber Security Centre (ACSC) told ACL it had intelligence suggesting Medlab may have been the victim of a ransomware attack, and reminded ACL of its notification obligations. ACL did not investigate further. On 16 June 2022, the ACSC advised ACL that Medlab data had been published on the dark web. ACL notified the OAIC on 10 July 2022, and made its first public disclosure on 27 October 2022, after a lengthy process of identifying affected individuals (The Guardian). The OAIC opened a commissioner-initiated investigation in December 2022 and commenced civil penalty proceedings in the Federal Court in November 2023 (OAIC). By the time of judgment, ACL had admitted the contraventions and consented to the court making penalty orders on agreed terms.
The legal question: three separate failures
The case, Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224, was decided by Justice Halley on 8 October 2025. The proceedings were brought under s 13G of the Privacy Act 1988 (Cth), which makes an entity liable to a civil penalty if it does an act or engages in a practice that is a serious interference with an individual's privacy (Privacy Act 1988 (Cth)). Justice Halley found that ACL had contravened the Act in three distinct ways, and each failure attracted its own penalty:
- Security: Australian Privacy Principle 11.1 requires an APP entity to take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, and APP 11.3 makes clear that this includes both technical and organisational measures. For an organisation holding the health information of millions of patients, the reasonable steps expected are high. The court found that ACL failed to take reasonable steps to protect the personal information held on Medlab's systems between May 2021 and September 2022, which amounted to more than 223,000 contraventions of s 13G(a), one for each affected individual. The penalty for this failure was $4.2 million (OAIC).
- Assessment of the breach: Australia's notifiable data breach scheme, which has applied since 2018, imposes obligations under Part IIIC of the Act. Section 26WH provides that when an entity becomes aware that there are reasonable grounds to suspect an eligible data breach, it must carry out a reasonable and expeditious assessment of whether there are reasonable grounds to believe the circumstances amount to an eligible data breach, and must take all reasonable steps to ensure the assessment is completed within 30 days. The court found that ACL did not carry out an assessment of the depth the Act required, relying instead on the limited external review. The penalty was $800,000.
- Notification: Section 26WK requires an entity that is aware of reasonable grounds to believe an eligible data breach has occurred to prepare a statement describing the breach and give it to the OAIC as soon as practicable. The delay in providing that statement was itself a separate contravention, attracting a penalty of $800,000 (OAIC).
The reasoning behind the penalties is what transfers to other businesses. Justice Halley described the contraventions as "extensive and significant", finding that they resulted from a failure to act with sufficient care and diligence in managing the risk of a cyberattack on the Medlab systems. His Honour noted that ACL's most senior management were involved in the decisions about integrating Medlab's systems and about responding to the attack, including whether it amounted to an eligible data breach. The contravening conduct had the potential to cause significant harm to individuals whose information was exfiltrated, including financial harm, distress or psychological harm and material inconvenience, and the potential to erode public trust in entities that hold sensitive information (OAIC).
Finally, the penalty regime matters. The penalties were calculated under the rules in force when the conduct occurred, which capped each contravention at $2.22 million. The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth) commenced on 13 December 2022 and raised the maximum penalty for a body corporate to the greater of $50 million, three times the value of any benefit obtained from the contravention, or 30 per cent of adjusted turnover, per contravention. Because ACL's conduct predated the reforms, it was assessed against the old, lower limits. The OAIC has said that future action will be subject to the higher penalty provisions now available (OAIC).
Why this matters to your business
The judgment translates into six practical consequences for any business that handles personal information:
- The response is a legal process, not an IT job: once you suspect an eligible data breach, the Act imposes a statutory duty to assess it and to take all reasonable steps to finish within 30 days. How you investigate is now itself a compliance question.
- A consultant's sign-off is not a defence: ACL relied on an external review that found no evidence of exfiltration. The court treated that thin assessment as part of the contravention, not as an excuse.
- "As soon as practicable" is a legal test: the delay in notifying the OAIC was penalised separately, to the tune of $800,000.
- Penalties have multiplied since: the maximum per contravention is now the greater of $50 million, three times the benefit, or 30 per cent of adjusted turnover. An equivalent breach today would be assessed against limits roughly 20 times higher than the ones ACL faced.
- Small businesses are not automatically exempt: the small business exemption in s 6D applies only to businesses with annual turnover of $3 million or less, and even then it does not apply to health service providers, businesses that disclose or collect personal information for a benefit, contracted service providers for Commonwealth contracts, credit reporting bodies, or businesses related to a larger company (Privacy Act 1988 (Cth) s 6D).
- The regulator is watching: the OAIC pursued this case for almost three years, and its Commissioner has said the outcome is a reminder to all APP entities to remain vigilant.
The lesson that transfers most directly is how "reasonable steps" is judged. It is judged on what you knew and when. The OAIC alleged that ACL was aware of serious deficiencies in its cybersecurity framework at least nine months before the attack and did not take adequate steps. It is also judged on organisational measures, not just firewalls and passwords: ACL's lack of a dedicated cybersecurity team, an untrained responder and an unread playbook all featured in the case. And the judgment shows that courts look at who in the business knew what. Senior management involvement in the decisions was part of the picture, not a defence to it.
If you take nothing else from the case, these are the changes worth making this week:
- Run an incident response drill this month: a tabletop exercise will show whether anyone in your business knows that a suspected breach starts a statutory assessment clock with a 30-day completion target.
- Document your reasonable steps now: write down the technical and organisational measures you take to protect personal information, so you can show a regulator what you did before an incident, not after.
- Nominate a breach response lead: decide in advance who coordinates the assessment, who has authority to notify the OAIC, and how a suspected breach is escalated to senior management.
- Pre-draft your notification statement: s 26WK sets out what the statement to the OAIC must contain, and having a template ready removes friction at the moment it matters.
- Confirm whether the Privacy Act covers you: check the small business exemption in s 6D, including the health service and personal information trading carve-outs, and get advice if you are unsure.
How a privacy lawyer can help you get the response right
The pattern in the ACL case is one a privacy lawyer sees regularly: a business treats a cyber incident as a technical problem, then discovers that the law imposed deadlines and duties the whole time. Legal help is most valuable before an incident, when it is cheap, and in the first days after one, when the obligations start running.
Before a breach, a lawyer can run a gap analysis of how your business handles personal information against the Australian Privacy Principles, review your incident response plan against Part IIIC, and advise on the contracts you have with IT providers and forensic consultants. The terms of those engagements matter: ACL's external review was meant to be its protection, but the engagement was so limited that the assessment failed.
After a suspected breach, a lawyer can help you scope a s 26WH assessment, decide when awareness crosses the threshold into notification obligations, and draft the s 26WK statement in the form the OAIC expects. That is the moment "as soon as practicable" gets tested, and it is where ACL came undone. If the OAIC opens an investigation, a lawyer can manage the process, negotiate the factual admissions, and put a penalty position to the regulator. Getting the timing and the documentation right under pressure is precisely the benefit of having someone who knows the Act on call.
The lesson from ACL: the hack is not the penalty event
The next time a ransomware email lands in an inbox at your business, remember this: ACL was not fined for being hacked. It was fined for treating the aftermath as an IT problem when the Privacy Act makes it a legal one. A thin investigation, a missed assessment duty and a notification that came too late produced a $5.8 million penalty, calculated under penalty limits that have since multiplied.
The case is the first civil penalty ever ordered under the Privacy Act 1988 (Cth), and it came against a business that admitted no deliberate wrongdoing. APP 11 made security a legal duty measured against reasonable steps, and Part IIIC made the response a legal process with its own deadlines. The penalty was $4.2 million for the security failures, $800,000 for the failed assessment and $800,000 for the late notification. For any business holding personal information, compliance is now judged at two moments: before a breach, on the measures you put in place, and after one, on the speed and depth of your response.