A judge has signed off on a 27.5 per cent group costs order in a consolidated shareholder class action against Medibank over a cyberattack that affected 10 million customers, noting the “significant risk” taken on by the two plaintiff law firms running the action.