Lawyers will allege that Medibank failed in its duty to protect its customers by having inadequate cybersecurity controls, resulting in the personal data of nearly 10 million Australians being uploaded to the dark web by criminals in Russia.

The class action – brought by Baker McKenzie on behalf of 9.7 million Medibank members – alleges that the insurer breached the Australian Consumer Law by engaging in misleading or deceptive conduct or making false or misleading representations after its systems were breached.