Optus Hack Exposes Data of Nearly 2.1 Million Australian Telecom Customers

Australian telecom giant Optus on Monday confirmed that nearly
2.1 million of its current and former customers suffered a leak of
their personal information and at least one form of identification
number as a result of a data breach^[1]
late last month.

The company also said^[2]
it has engaged the services of Deloitte to conduct an external
forensic assessment of the attack to “understand how it occurred
and how we can prevent it from occurring again.”

Optus is fully owned by Singaporean telecommunications
conglomerate Singtel, which also has a significant stake in Bharti
Airtel, the second largest carrier in India.

“Approximately 1.2 million customers have had at least one
number from a current and valid form of identification, and
personal information, compromised,” Singtel said^[3]
in an announcement made on its website.

It also said the breach affected expired IDs and personal
information of about 900,000 customers. It further emphasized that
the exposed data did not contain valid or current document ID
numbers for some 7.7 million customers.

The leaked data is said to contain email addresses, phone
numbers, and dates of births, necessitating that customers remain
cautious about potential phishing and smishing attacks.

The company also said it has notified users whose current
identification documents had been compromised in the attack. This
includes driver license numbers, card numbers, and Medicare ID numbers^[4].

Of the 9.8 million customer records exposed, 14,900 valid
Medicare IDs and 22,000 expired Medicare card numbers are estimated
to have been exposed, Optus previously disclosed on September
28.

The security incident, which came to light on September 22,
involved a malicious actor gaining unauthorized access to customer
information. It’s not immediately clear how and when the actual
intrusion took place.

The attacker, using the alias “optusdata,” subsequently
published a published a small sample of the stolen data belonging
to 10,200 users and demanded that Optus pay a $1 million ransom to
avoid more leaks.

The self-identified hacker has since withdrawn the extortion
demand while apologizing for the crime and claiming that the “only
copy” of stolen data had been destroyed, citing increased public
attention.

While it’s not known if “optusdata” is the person/group
responsible for the breach, the Australian Federal Police (AFP) has
launched twin operations to identify the perpetrators^[5] behind the attack and
“supercharge the protection” of the 10,200 customers.

The latter, called Operation Guardian, offers
“multi-jurisdictional and multi-layered protection from identity
crime and financial fraud,” with the agency stating the impacted
users had 100 points of identification released online.

“There are reports that sophisticated scammers are contacting
Optus customers via phone, email, and text to get further personal
information from the victims of the breach,” the AFP warned^[6]
last week.