Optus - Major Data Breach

Some good resources here.

https://www.cyber.gov.au/acsc/view-all-content/alerts/optus-…

Optus has suffered a massive data breach, compromising the personal information of up to 9 million customers.

About 2.8 million customers have had all their personal details taken in the cyber attack, including their passport and licence numbers, email and home addresses, dates of birth and telephone numbers.

About 7 million had their dates of birth, email addresses and phone numbers stolen.

The breach involves both current and former customers.

This is worrying.

22/9: Optus’s statement.

Mod 26/9: Whirlpool - Check Optus Customer API

Related Stores

Optus
Optus

Comments

        • +2

          rainbow table attack. just a table of pre-computed hashes for common passwords. won't crack all passwords but will get many weak passwords

          • @c64: true but I was talking about if you have the hash and want to reverse it, the only way is to reset the password

            • @subwoofer: yes in an ideal environment, but who knows what optus's security is like. i get the impression it is a shambles

              optus said passwords weren't breached, so they were salted and stored in a secure manner. pity about all the other data

            • @subwoofer: We've already told you two (albeit practically the same) ways to reverse a hash..

              Just go through a list of known text:hash strings, or run the hash algorithm over a list of common alphanumeric passwords until you find a match.. easy!

  • +2

    Alot of dissapointment about this whole endeavor. Focusing on whats in my control right now until more information comes to light / optus takes action to notify me that my important data's in the wind; ensuring all 2fa is enabled, ideally via application (not sms) where possible, placed a ban on credit reports through https://www.experian.com.au/consumer/request-a-ban (you can tick a box to notify the other major reporting agnecies). Il probably keep updating the ban as long as feasable, until more info comes to light or circumstances change, whatever comes first (I know its not for for everyone due to circumstances).

    TLDR; Its happened, you have a right to be angry and feel uneasy. Just focus on whats in your control and make the best choice you can to protect yourself based on your own circumstances. All in this together unfortunately : /

    • Just wish there is a way to get more information on what exactly got compromised. Changing mobile phone number isn't that pleasant. Will Optus be willing to fund the cost of a driver license replacement?

      Hoping for prepaid, Optus did not store id details.

      • As others have said below, complain to chat and they will tell you what was compromised.

    • Is there direct link to the other providers? Experience only notifies them. We don’t get a confirmation if the other providers did anything.

  • +1

    just contacted live chat, confirmed not affected (incredibly there are some of us?). I signed up for recent qantas 100gb/m sim deal.

    • That is your only Optus service since 2017?

    • +7

      I wouldn’t take live chats word for it. They said I wasn’t affected earlier today then I received the email saying my full details were leaked

      • is that different to the standard generic apology email from the ceo?

  • +5

    Dear CC123,

    It is with great disappointment I’m writing to let you know that Optus has been a victim of a cyberattack that has resulted in the disclosure of some of your personal information.

    Importantly, no financial information or passwords have been accessed. The information which has been exposed is your name, date of birth, email, phone number, address associated with your account, and the numbers of the ID documents you provided such as drivers licence number or passport number. No copies of photo IDs have been affected.

    It is also important to know that Optus’ network and Optus services including mobile and home Wi-Fi aren’t affected, and no passwords were compromised, so our services remain safe to use and operate as per normal.

    Upon discovering the cyberattack, we immediately took action to shut it down to protect your information. Our priority is our customers – so while our investigation is not yet complete, we wanted you to be aware of what has happened so that you can be extra vigilant at this time.

    We are currently not aware of customers having suffered any harm, but we encourage you to have heightened awareness across your accounts, including:

    • Look out for any suspicious or unexpected activity across your online accounts, including your bank accounts. Make sure to report any fraudulent activity immediately to the related provider.
    • Look out for contact from scammers who may have your personal information. This may include suspicious emails, texts, phone calls or messages on social media.
    • Never click on any links that look suspicious and never provide your passwords, or any personal or financial information.
    • If people call you posing as a credible organisation and request access to your computer, always say no.
      You would have seen we announced this first in the media. We did this as it was the quickest and most effective way to alert you and all our customers, while also communicating the severity of the situation through trusted media sources.

    For the most up-to-date information and FAQs, go to optus.com.au. If you believe your account has been compromised, you can contact us via My Optus app – which remains the safest way to contact Optus, or call us on 133 937.

    We apologise unreservedly and are devastated this could occur. We are working as hard as possible with the relevant authorities and organisations to ensure no harm comes from this unfortunate occurrence.

    Warm regards,
    Kelly Bayer Rosmarin
    CEO, Optus

    Welp

    • +4

      Fark

    • +6

      I guess with this level of security and coming up to Christmas there is no need to worry about opening hours or even paying for Handsets.
      Just walk in a grab what you like.

      Also:

      Q. Hacker: Can I have access to your entire database?
      A. Optus: 'yes'

    • +1

      Did everyone get that email? Or just people affected

      • +2

        They intend to notify customers who are affected based on the level of data breach. So starting with people with ID documentation data compromised I am guessing. I sincerely hope Optus will notify previous customers as well, rather than ignoring them or treat them like second class citizens.

        • I got the same email that @CC123 got, just unaware if that was a generic email to everyone with Optus.

          • +2

            @inDahoud: I did not get it. And I'm a current customer from the recent Samsung Tab deal.

            I'm taking that as a good sign (so far), but I still put a credit ban on for the time being until I hear more…

        • Got it too. Got 2 services including from the A8 deal, not my main number and data only. At least don't have to worry about spam

      • yep I got the exact same email, and only ported out of Optus a few weeks ago fml

    • +1

      I thought the CEO said they wouldn't do it via e-mail. So, they still elected to do the cheapest way and e-mail customers?

      • +2

        You sure it's the CEO… could have had her account hacked :D

        • +1

          Took her identity and clone her. Then have the clone fronting the media?

          Her account most likely would be in that list because if she is not an Optus customer herself, then she shouldn't be Optus CEO.

    • +7

      So… to summarise: We farked up, our systems appear fine. You're farked though. Oopsies.

    • sorry to hear that mate, are you a current customer or previous customer?

      • +2

        Current customer of 4 years, soon to potentially be a former customer

        • +1

          Former customers aren't safe either. I am still cynical about Optus will notify previous customers promptly (that's what a CSR told me, not what the CEO said). I can still login to Optus and Optus is still doing 2FA when I logged in.

          • @netsurfer:

            Former customers aren't safe either

            Well aware of that, been planning to jump ship to Boost for a while anyway

            • @CC123: Are you currently an Optus prepaid customer or on a plan (postpaid)? I think I was switching phone provider recently and Optus prepaid was on special, and then this happened.

              • @netsurfer: Postpaid but out of contract

                • @CC123: Leaning towards getting a new mobile phone number.

    • +2

      Yep got the email too. So now members are getting notified, I expect one of the following:
      - Optus getting on the front foot, acknowledging they stuffed up and compensating people - personally I want them to come out and offer 3rd party surveillance for identity fraud (ie to my understanding most of the major credit reporting groups offer an active service like this, signing up 9 million new customers, I'm sure they'd get it at a discount lol) for a fixed time frame, plus (and much more effort so far less likely) and lobbying to app govt bodies to allow for change of compromised document numbers and compensation for govt costs for this.

      Or (and IMO far more likely) ;

      • Optus pulls a South Park, says sorry while lying on a bear rug and does nothing, resulting in a class action.
  • +1

    Got off the phone with Muzeeb. He said I was unfortunately affected and he stressed the importance of being vigilant about security, and that it is a lesson for everyone moving forward.

    • +4

      It would be good if Optus offers each affected customer (or ex-customer) a new mobile phone number SIM or eSIM free of charge for a few months. Thing is, would we trust Optus to store our ID document data again?

      I want to change my mobile phone number but it's a pain.

  • +10

    I just watched the Optus CEO answer questions with ridiculous answers, calling for 'All Australian businesses to be vigilant' and keeps on trying to tell us that it's our group responsibility as Australians… Then she says stupid rubbish like it's ONLY 9.8 million people effected… WTF

    What a joke. However, Muzeeb offered me a further 10% off if I add another service.

    • +9

      Most CEO's are good for nothing, shit talking, patting their own back kind of people. They are like politicians… Can never get a straight answer out of them.

      • +7

        … But this CEO is just the worst, she is so happy with her answers, not even flustered… as it's only customers’ names, dates of birth, phone numbers, email addresses, and, addresses, driver's license numbers or passport numbers.

        She keeps saying she can't say too much… Why not? The hackers already have everything… She is treating us like the hackers and giving us advice that we must be vigilant in this day and age… horrible horrible company.

      • +2

        It happened under her watch so she's pretty much done for, I'd be expecting her resignation soon…

    • +1

      So, the worst case is all Optus customers and ex-customers are affected, hence 9.8 millions. They were hoping not all 9.8 millions had ID documentation data exposed.

      If you are / were a postpaid customer, then chances are Optus had your driver license details. Not sure about prepaid. However, name, DOB, address, mobile phone number being exposed bare minimum is already bad enough.

  • +11

    From an insider on another forum:

    jiggawatts:

    I’ve seen Optus “computer security” in action. I use quotes for a reason.

    There was a court-enforced order requiring them to apply security updates to their production systems. That was in response to a previous breach.

    You see, until a judge made them do it… they weren’t patching anything. They would just build systems and walk away. For some software systems they had every major and minor version deployed, like a museum of software history.

    They had operating system versions in production that were in my university text books… in the late 1990s.

    Their interpretation of the court order was to update only production systems. Non-production on the same network was not to be touched.

    And by “update” they meant simply running the system update tool, which does precisely nothing on software that has passed its end-of-extended-support before some of the IT staff on the payroll were born.

    They also fired their entire IT staff recently and replaced them with a low-cost Indian outsourcer.

    Most of the above is a matter of public record. I wish I could tell you all about things that are still under NDA.

  • +2

    Seems like MVNOs like Amaysim and Circles aren't impacted. I've emailed them both and had it confirmed.

    Furthermore if you are a previous customer of Optus you can contact them via live chat on this page to see if you're personally impacted. https://www.optus.com.au/notices/messaging

  • +5

    Just requested credit ban for Experian and Equifax. Experian provided immediate confirmation but yet to receive anything from Equifax.

    The whole situation has been very poorly handled by Optus.

    • +2

      dont forget about illion

    • What does these bans do?

    • Do these bans negatively impact your credit score/rating?

    • Any response from Equifax yet? I received confirmation from the other agencies but nothing from Equifax.

  • so im porting another number to optus for the 50% off deal which was posted in deals a week or 4 ago, and they called to confirm my details and they said I was impacted by the cyber attack

  • +4

    In the email i recevied this afternoon i.e. 24 hours after the breach:

    It is with great disappointment I’m writing to let you know that Optus has been a victim of a cyberattack that has resulted in the disclosure of some of your personal information. Importantly, no financial information or passwords have been accessed. The information which has been exposed is your name, date of birth, email, phone number, address associated with your account, and the numbers of the ID documents you provided such as drivers licence number or passport number. No copies of photo IDs have been affected

    at this point a password attack would have been better given that I can just (profanity) change it

    • :/ are you a current customer or a previous customer?

  • APT%%

  • Thanks machej for providing the link to online chat:
    https://www.optus.com.au/notices/messaging

    Optus currently doesn't give out much information. The below information is completely unofficial.

    If you asked Optus CSR regarding whether you are affected, the CSR probably will perform a check on whether you are on their current system. If you are not (an older previous customer), then you might not be affected by the data breach.

    • +1

      Optus CSR told me yesterday (via messaging in My Optus app) that my info wasn't breached- I have 2 accounts: mobile (signed up in 2021) and the Samsung A8 tab mobile data SIM (this year).

      I'm not sure how trustworthy it is though? I'm also looking to apply for a CC in the next few weeks, guessing I should quickly do it first then request for a ban on my credit report?

      • +3

        They told me this to but now I got the email saying everything was…

  • Is this why I'm getting so much spam emails lately? From the like of "William shoes" etc?

    • -1

      3 extra credit cards under your name lately, you didn't notice? 😊

      • +2

        be preemptive, wreck your credit history now so that noone in their right mind will give credit to any potential scammers

      • i never knew you could be this funny.

  • +8

    Get rid of the CEO!!!! Hopeless - and Chat doesn't help either. Customer Service must have been advised by Bayer und Bayer aka owner of Monsanto and Glyphosate to visit an Optus store as nothing can be done through app, only face to face, just now

    • Due to the data breach, Optus won't allow changes through online CSR (since personal details has been compromised). Optus needs staff to physically see the IDs.

      • -1

        So Singtel and Optus can further mine and sell info they already have? Optus and its owner SingTel should come forth with a statement that ALL Optus customers can receive, see and take appropriate action - where is a non- existent email from Optus aka SingTel to we Strayan customers of SingTel/Optus????????????????

      • +1

        So you're saying the answer to Optus losing all your personal data is to give them more?

        I didn't require anything more than a login and password into my account to cancel my services with them, sadly I don't think enough people will leave to make any real impact on their balance sheet.

        • I don't think Optus is asking for more information. Optus staff just needs to quickly sight the ID (I don't think the staff will record more information).

          However, I really don't think it is 100% locked down. For example, you don't need Optus' permission to port your mobile phone or NBN.

        • Thats rich! Why should I have to cancel my services and inconvenience myself becasue SingTel couldn't keep my data safe, along with that of another 9.8 million customers? On Ya for porting out but i don't want to lose my plan which is no longer available and i couldnt get from any Telco

          • @glyptothek: What exactly is the issue that additional measure has been put in place before changes can be altered? The main problem is that we are doing too many things online and SMS isn't secure.

            Honestly, Telstra isn't THAT good. Telstra did:

            • Accidentally add someone else's order into my account.
            • By refusing to pay excess fees for silent number years ago, my number was listed on whitepages for years. A spam caller told me flat out that my number is on whitepages (so no, they don't even need to pay to get the number). Then Telstra gave me the run around that it was my current VOIP provider. My VOIP provider told me that's BS because they don't list numbers in whitepages by default. I had to argue with Telstra for hours for them to admit it and then agree to remove it.
            • -7

              @netsurfer: Time to ditch China and its subsiduaries Malaysia Singapore n Vietnam Ethnic chinese control these nations and always have

              • @glyptothek: So Facebook selling our data is different? Just because USA firms are "smarter" at data mining, it's fine?

                What kind of excuse should we give to LinkedIn for their data breach in 2021?

                And, you are 100% sure the security specialists, solution architects working for Optus AU are NOT Australians? Honestly, if the leak on what happened was correct, allowing test networks to access prod networks seem very fishy. That's generally a big no no and how can development teams manage to achieve that? Normally, that would trigger immediate alarms at big companies.

  • +2

    Was watching the CEO pretty much non-answer anything…
    https://www.youtube.com/watch?v=NdWQdZu153E

    • +1

      Optus CEO: openness and transparency is what we believe is best.

      Um… really? Still have no idea what happened.

      • +1

        Yes Ms Bayer und Bayer ve Rosmarin was smiling and acting out like a typical CEO devoid of any humility and information

    • +2

      Probably got the top job to be woke and achieve gender quotas

      • Yes! Yes! Optus says Yes! Women are often seen as great divulgers of bad news, doom and increasing profits at the expense of customers. . Somehow women are seen as more caring? But backstabbing as soon as their fellow women leave the room……….

  • +2

    Great so many years after leaving their poor troublesome cable internet service they still manage to potentially cause me trouble.

  • +2

    The majority of cyber attacks go undetected. It is only in the news if they are amateurs who don't cover their tracks.

    • -1

      Thats so true! I got a letter from a legal firm a few month sago I used her in Straya Sad- Delayed a few months ago saying they had been hacked and that my personal info had been mined out - now class actions against lawyer firms as well as telcos

    • Going undetected isn't always a gauge of how experienced the attackers were, it's also an indication of how competent the targets are with their internal monitoring, prevention and detection processes.

      In this instance (let's assume it was http get requests) it wouldn't make any difference how "pro" the attackers are. If all they did was make 9 million http calls, they would have no way of cleaning up the webserver access logs.

  • I suspect this is why I got a dozen "attempted email access from suspicious account" messages a couple weeks back…

    • I got one this morning that Gmail didn't identify lol
      Checked my spam folder, usually get 3 spam a day. Will be interested to follow the trend now…

  • Does anybody know how to cancel and get a new Medicare card/number?

    • can be done by calling medicare or by reporting your card as lost or stolen through the app i believe.

      • does the number change or just the expiry date? i suspect just the latter

        • number and expiry change… from recollection it just increments the past number by 1.
          better than nothing and takes 5 mind to do

  • +2

    Sigh. I got an email confirming I was one of those whose data including DL/Passport ID were compromised. It would have been nice if they confirmed if it was my licence + passport or just one of the two. I doubt I provided both when signing up.

    • You can ask live chat, mine was just dl and Medicare. Not passport thankfully.

      • +1

        When I asked through the app (current customer) the rep had absolutely no clue what info of mine was leaked, they said, and I quote "our engineer is still working on it do not worry about it" as well as "it is not yet confirmed our team is still identifying on it, if our team didact something you will definitely get notified from Optus"

        That's what they said, word for word

        • That engineer needs a pay rise! Big job for one person.

    • my suggestion if its worrying you. (i did this)

      call up, threaten to leave and ask to speak to customer retention. They will tell you everything they got. i had to confirm my current details and they would tell me if it was leaked or not.

      turns out a lot of the information that optus had on me was expired and of no use.

      they are working all weekend.

      (took 2 hours)

      • Just curious what’s the reason behind changing the number ? How does it help when someone steals your ID?

        • +1

          Scammers can't take over your service number if you already changed it. Assuming you replace it everywhere you've recorded it, otherwise it's even worse to actively change your number.

        • im not going to pretend to be extremely tech savvy in scamming but have id say a rudimentary experience.

          i have 2fa on all my services including some services that are sensitive of nature on a certain industry.

          I wanted to change the number so i could lessen the risk of someone else porting me and using 2fa on any of my services (even though the passwords are extremely secure 16 character blah blah i think some of my services will let you reset with 1 form of 2fa e.g. sms and some of them require 2 forms of 2fa sms and email)

          also my theory if i change everything including DL number, phone number, medicare email etc then the data is pretty much mostly useless about me to a degree.

          • +3

            @bsl: Someone else porting your number is not that easy nowadays as one of the steps involves entering a one time code sent to the current mobile SIM. However, there is still one scenario someone could try (won't go into detail coz. don't want to educate the wrong people).

            I think organisations need to allow other forms of 2FAs other than SMS. There are ones who do that, but quite a few don't (and some moved away from those back to SMS).

            • +1

              @netsurfer: yeah thats my understanding to. I havent sim swapped in a long time but yeah from what i know they cant port you without a pin to your phone?!

              I would agree regarding 2fa. im required to use both app and sms for some niche services.

              one service i have to 2fa pretty much 10 times a working day through.

    • I hopped on to the online service. They confirmed it was my licence. A bit annoying for me since I just got a new passport.

  • +3

    I got notified that all my data was leaked. (all fields)

    I called up to swap numbers and they wanted to switch me to a new plan and number which was more expensive and they couldnt help…

    asked to be put through to customer retention repeatedly (took 2 hours of politely being stern) and they were very helpful.

    they went through exactly what information was leaked and put notes on my account and were willing to move mountains.

    im still wary but they didnt get a lot if information i was ready to change to protect myself.

    if your considering leaving or concerned call them up and firmly ask to speak to customer retention and they have a lot more details than the normal reps and will do a lot more for you.

    • All i got two weeks ago was $15.00 discount on mobile wouldn't touch anything else………. What saving cost are you talking about?

      • +1

        Im on an ancient plan and they cant move me due to t&cs. Current plans are $20 more and less data.

        I wasnt arguing to save money so its not the same as your case i was arguing to keep my plan which they didnt want to do.

        in short, 2 hours offshore no progress, 10 mins onshore and they would do everythint i wanted. (switch to a new number and keep my old number on a cheap plan for a month)

        during the call i asked them to clarify what information they had on the system and whilst they got DL they didnt get card number or medicare etc so im waiting to see before i switch the number ive had for 20 years.

        • Thankyou for the time, I see that your account is not been flagged as victim of Cyber Attack

          Optus has also notified key financial institutions about this matter. While we are not aware of customers having suffered any harm, we encourage customers to have heightened awareness across their accounts, including looking out for unusual or fraudulent activity and any notifications which seem odd or suspicious.

          I got this tonight, when I asked about changing mobile number to a new number.

          Constantly used this script "Please be rest assured."

Login or Join to leave a comment