A judge has approved a bid to consolidate two shareholder class actions against Medibank over a cyberattack that affected 10 million customers, finding that having two firms on the record is better than a carriage contest.