A recent Federal Court ruling is a stark reminder that a cyber attack can hit any business – large or small. But simple precautions and expert advice can dramatically reduce your risk, protecting your data, your reputation and your bottom line.
Australian Clinical Labs (ACL) was recently fined $5.8 million after a major data breach, marking the first civil penalty under the Privacy Act. The Court found ACL failed to take reasonable steps to secure highly sensitive data stolen during a February 2022 ransomware attack on its recently acquired Medlab Pathology systems.
Since December 2022, penalties for privacy breaches have risen sharply – up to $50m per breach. The cost of getting this wrong has never been higher.
In late 2021, ACL acquired Medlab Pathology, including its outdated IT infrastructure. Two months later, a ransomware group infiltrated the system, encrypting files and stealing about 86GB of data.
ACL initially relied on incorrect advice from an external cybersecurity provider and did not notify the Office of Australian Information Commissioner (OAIC) or affected individuals until months after the breach.
ACL had:
Business Law WA Commercial Law Legal Director Cass Wright says cyber threats continue to escalate, with ransomware being a persistent threat.
“In this instance, ACL was also penalised in respect of delaying assessment of the suspected data breach and also notification to the OAIC, it’s important that businesses know their obligations and get legal advice if they suffer a data breach” she says.
“Every business needs a cybersecurity protocol and clear response measures in place.”
If your business experiences a cyberattack or scam:
If you need help with a cyber security plan, due diligence during an acquisition or to understand your obligations under the privacy laws or how the Privacy Act may impact your business, contact the Commercial Law team at BusinessLawWA@cciwa.com or call (08) 9365 7560.
CCIWA, Business Law WA and REEFWA has taken all reasonable care in preparing this document. The contents of this document do not constitute legal advice and should not be relied upon as such. Specific advice for your situation should be sought from CCIWA, Business Law WA or a professional adviser before any action is taken. Neither REEFWA, CCIWA nor Business Law WA accept responsibility for any claim that arises from any person acting or refraining from acting on the information contained in this document.
“REEFWA are an exceptional corporate body that provides real time advice, advocacy and detailed information on all industrial relations matters pertaining to our industry. They operate with professionalism and personal service. Beneficially for you, they have a broad range of highly experienced personnel that work in the industry and offer years of knowledge.”
Friday 13 November 2026 | 9:00am – 5:30pm AWST |Aloft Perth, 27 Rowe Avenue, The Springs. RIVERVALE WA 6103
Various Dates Available, Use the link below to find out more
Various Dates and Topics, Click the link below to learn what is coming up.
