ASX-listed pathology provider Australian Clinical Labs faces potentially millions of dollars in fines for failing to protect sensitive financial and health data, such as patient screening for sexually transmitted diseases, when its customers’ data was stolen in a 2022 cyberattack.

A concise statement filed by the Australian Information Commissioner in the Federal Court, and published on Tuesday, lays bare its case that ACL had woefully insufficient cybersecurity protections and plans in place, and had failed to alert authorities and customers to the breach quickly enough.