Any class action taken against Optus over the data breach exposing customers to identity theft is likely to succeed and could result in billions in compensation being awarded, to be Australia’s largest and most costly case, University of Newcastle law academics say.

There’s a “strong basis” to believe a class action would be successful given the Optus data leak is established, Mirella Atherton and Eliezer Sanchez-Lasaballett say.

“Though the economic loss per customer may be relatively small, multiplied by the potential class-action pool size – up to 10 million plaintiffs – compensatory damages could easily be billions of dollars, even without exemplary damages,” an article they wrote for The Conversation said.

“That makes this a hugely attractive prospect for a law firm or class-action funder.”

Maurice Blackburn and Slater & Gordon have already said they are considering action.

If action proceeds, a court could force Optus to pay compensatory damages for the time and cost of replacing identification documents, the academics say, as well as damages to “send a message to corporations handling citizens’ private information”.

A court will take into account what efforts Optus has made to remedy the leak, mitigate the potential impact on those affected and pay for the costs of replacing drivers’ licences, Medicare cards or passports.

The academics say there are two main ways any class actions could proceed against Optus: negligence or breach of privacy.

The scope of negligence liability is dependent on state or territory legislation. To succeed, a court would have to find Optus had a duty of care to its customers to protect their personal information, that it breached its duty, and that customers suffered damage or loss.

For contravening the Privacy Act, the Federal Court would have to find that personal information held by Optus was subject to unauthorised access or disclosure, or lost, and that the company failed to comply with the privacy principles.

A class action could also argue a breach of the Telecommunications Act and failure to protect from unauthorised access.

The academics say the closest precedent in Australia to a successful class action for a mass breach of privacy is a 2019 case in the NSW Supreme court. NSW Health was ordered to pay $275,000 in compensation to 108 ambulance service employees after their personnel files were sold to a law firm by a contractor.

Multiple class actions are possible if those claims pursue different issues, or the firms sometimes elect to work together.

There have been about 700 class actions in Australia in the past 30 years. Less than 5% of Federal Court actions have progressed to a judgment, and around 60% have ended in a court-approved settlement.

According to Australian Law Reform Commission data for settled cases, the median percentage of any settlement going to plaintiffs is 57%, with law firms taking 17% and funders 22%.

A record $500 million was paid out by power distributor SP AusNet, the Victorian government and Utility Services Corporation to 10,000 victims of Victoria’s 2009 Black Saturday bushfires. In April, the Federal Court ruled more than 260,000 Toyota HiLux, Prado and Fortuner vehicles were sold with faulty diesel particulate filters.

With an expected average compensation payout of $10,500 per vehicle, Toyota could face as much as $2.7 billion in compensation owed.