What Is The Optus Data Breach, And Do I Need To Be Worried?

Get all the info you need.

If you’ve turned on a tv, computer, or phone, read the newspaper, or even stepped outside in the past few days, there’s no doubt you’ve heard of the Optus data breach.

There’s been so much information everywhere over the past week, and it’s unclear as to what’s happened, who’s been affected, and whether they need to be worried.

So – we thought we’d cover off on everything that’s happened this week and give you all the info you need.

What’s actually happened?

Optus are continuing their investigation alongside the Australian Federal Police (and the FBI), so there’s a lot we still don’t know, but we do know the bones of what’s been going on.

It all started about a week ago when Optus revealed a targeted hack had accessed the data of nearly 10 million Optus customers, including their personal information as well as identifying data such as driver’s license numbers, passport numbers and Medicare numbers.

This was huge news on the day, but it only got bigger.

A short time later, a hacker, going by the username ‘Optusdata’ posted on a data breach forum identifying themselves as the attacker, and demanded a ransom of $1 million US in cryptocurrency, and threatened to sell the data.

The Optus hacker apparently wants $1 million, so basically the greatest data heist in history is worth less than a 2-bedroom apartment in Petersham.

— Byron Kaye (@byronkaye) September 24, 2022

Optus has said they have not and will not pay the ransom.

The hacker also then posted the data of around 10,000 customers on the same forum.

That was a pretty scary outcome – but it just got weirder from there.

In another post, ‘Optusdata’ apologised, deleted the initial post, and claimed they had deleted the only copy of the stolen data.

That might sound promising, but unfortunately, there’s no way to verify if that person was the real hacker.

And even if it was the real hacker, there’s no guarantee that they were the only person who noticed the vulnerability.

How did this happen?

Again, it’s a little unclear. Optus has called the hack a “sophisticated attack”, but that might not be the case.

Reports around the breach are suggesting the hacker was able to log into an online application programming interface, which didn’t require authorisation or authentication.

Home affairs minister Clare O’Neil likened it to leaving a window open.

This wasn’t a “hack”. Optus literally left the door wide open. The perp simply used a connection that wasn’t password protected to download the data.

THAT’S a bigger story than a hack.

Optus are culpable because the data was exposed and unprotected.

It wasn’t hacked.

— 𝗝𝗮𝘀𝗼𝗻 𝗝𝗼𝗿𝗱𝗮𝗻 (@jasonjordan) September 27, 2022

The Federal Government are very concerned with the security breach and are considering punishing Optus for potentially putting customers at risk.

How do I know if I’ve been affected?

The attack has only affected Optus users, reportedly stretching back to 2017.

Not all customers have been affected, and Optus has been contacting customers via email to let them know if they are a part of the leaked data.

So check your email for correspondence from Optus – contained within the email are some instructions on what to do along with some extra information.

Do I need to be worried? And what should I do?

Worried probably isn’t the right word – Optus and the government are urging people to be vigilant, and on the watch for fraudulent activity.

The key concerns are your identity documents: your passport, driver’s license and Medicare numbers.

If you have been affected, you can easily apply for a new Medicare number with myGov.

Renewing your driver’s license number depends on your state, but over the past week, state governments have released information on how you can easily renew your license.

This might range from visiting a service centre like in WA, Tasmania or SA, or by going online and filling out a form, like in Victoria.

Passport renewals can be done via the Passport replacement portal – it currently costs $193 to replace a passport, however foreign affairs minister Penny Wong has officially called on Optus to foot the bill for all the affected customers.

Here is the letter @SenatorWong sent to Optus telling the company that it should cover the fees for new passports for hacking victims — says there is no justification for taxpayers to pay. @abcnews https://t.co/rjdxX9qOFS pic.twitter.com/lKmqJRvssI

— Nour Haydar (@NourHaydar) September 28, 2022

All of these replacements are entirely up to you – a person can’t travel with just your passport number, nor can they access medical information with your Medicare number.

However there is still a risk of identity theft.

With more information coming out every day, it’s key to stay on top of the recommendations, and do what’s best for you.