$5.8 Million Fine. No Multi-Factor Auth. No Excuse.

Pathology worker at a lab workstation with red data-breach alerts on screen

Estimated Exposure: 223,000 patients. $5.8 million penalty.

What Happened: Australian Clinical Labs got breached in 2022. Hackers walked through the front door — no multi-factor authentication, firewall logs kept for only one hour, no proper incident response plan. 223,000 patient health records stolen. Medication histories that reveal mental illness, fertility treatment, gender transition. All posted for sale on the dark web. The Federal Court didn’t just fine them — they broke it down: $4.2 million for not securing data. $800,000 for not investigating. $800,000 for not reporting it fast enough. First civil penalty ever imposed under the Privacy Act. The court said they “failed to act with sufficient care and diligence.”

Message: Australian regulators: ignorance is not a defence. Negligence has a price tag.

Source: Federal Court of Australia [2025] FCA 1224, OAIC prosecution

The Federal Court ordered Australian Clinical Labs to pay $5.8 million in civil penalties following the 2022 Medlab Pathology data breach.

Read the OAIC account of the case.

Explore More Case Studies

A towering wall of identical pigeonhole slots, every one filled, lit red

5 Hours From Disclosure To Mass Exploitation.

Patchstack measured the median time from public disclosure to mass exploitation of a WordPress vulnerability at five hours. 46% have no patch when disclosed.

View Case Study
An aisle of a public records room at night, shelves of bound judgments lit red

$235,400 Gone — And the Victim Got the Blame. WA Court.

What Happened: BEC invoice fraud. $235,400 stolen, only $43K recovered. WA District Court ruled the VICTIM was legally liable.

View Case Study
A filing cabinet with every drawer wrenched open and its contents spilled across the floor

106 GB of Employee Data — Published. Perth Company.

What Happened: DragonForce ransomware hit a WA industrial company. 106+ GB exfiltrated and published.

View Case Study

Get Certified Before
You're the Next Headline

Every story on this page started the same way — a published vulnerability, a site nobody was watching, and weeks before anyone noticed. The free scan looks at your site from the outside, the same way an automated scanner does. It costs nothing, there is no obligation, and it takes about thirty seconds to start.

Scan My Site — Free