Technically, Medibank could face a fine of $21.5 trillion as a result of legal action taken by Australia’s privacy watchdog the Office of the Australian Information Commissioner (OAIC) for the theft of personal details of 9.7 million Australians in a 2022 cyberattack. If it loses (and it's defending the action) it'll pay a fraction of that. Medibank is already the subject of four class actions relating to the cyberattack.