The law firm’s statement of claim, filed in the Federal Court, alleges Medibank and its subsidiary Australian Health Management breached privacy and consumer laws as well data retention legislation.

Members of the class action are seeking compensation for losses, including time and money spent replacing identity documents.

They are also seeking damages for non-economic losses like distress, frustration and disappointment.

At least 9.7 million Medibank customers had personal information including names, dates of birth, addresses and phone numbers compromised during the October 2022 data breach.

Medicare card numbers of at least 2.8 million customers were also released online, along with health claims data of 480,000 customers.

“This was one of the most serious data breaches in Australia’s history,” Slater and Gordon class action practice group leader Ben Hardwick said.

“Medibank should have had adequate measures in place to prevent all of this, yet they didn’t.”

Medibank has previously said it was supporting affected customers through its cyber response support program, which includes mental health and wellbeing support, identity protection and financial hardship measures.

In a recent investor update, the health insurer said it expected to spend up to $45 million on non-recurring expenses related to the hack.

It noted the figure excluded further potential remediation and litigation-related costs.

Slater and Gordon’s class action follows similar compensation claims from law firm Baker & McKenzie and legal firm Quinn Emanuel on behalf of Medibank shareholders.

Several other firms have flagged they will file similar actions against Medibank, including a conglomerate involving Maurice Blackburn Lawyers, Bannister Law Class Actions and Centennial Lawyers.

-with AAP