Loading story…
Optus suffered a major breach that exposed personal information belonging to about 9.8 million current and former customers, including names, dates of birth, addresses, phone numbers, email addresses, and, for roughly 2.8 million people, passport or driver’s licence numbers. Australian officials publicly disputed Optus’s description of the intrusion as sophisticated, citing claims that an internet-exposed unauthenticated API and weak access controls enabled what the cybersecurity minister called a “basic hack,” while the company maintained a skilled criminal was responsible. The incident triggered investigations by the Australian Federal Police, the information commissioner, and ACMA, and intensified scrutiny of telecom-sector cyber oversight and penalties.
A BreachForums user claiming responsibility demanded about US$1 million and threatened to publish stolen records in batches before later posting an apology and claiming the data had been deleted, a statement authorities did not verify. The fallout included identity-theft warnings, state support for replacing compromised licences, Optus-funded document replacement and credit monitoring, customer backlash over poor communications, and at least one criminal case involving alleged misuse of the stolen data to blackmail victims. The breach also led to a Deloitte review, court fights over disclosure of that report, customer losses, and a large class action as Australia moved to strengthen information-sharing and cyber laws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
15 events from the most recent confirmed update back to the earliest known activity.
In November 2023, Optus lost a court bid to keep secret a Deloitte report into the cause of the 2022 cyberattack. The ruling increased public scrutiny of how the breach occurred and how Optus handled the aftermath.
As of June 2023, regulatory and criminal investigations into the Optus breach were still underway, and a class action involving about 100,000 affected customers was in progress. The incident continued to drive legal and policy consequences in Australia.
By March 2023, Optus CEO Kelly Bayer Rosmarin said a skilled criminal was behind the attack and acknowledged that the company had lost customers following the breach. The statement reflected the continuing business impact months after the incident.
In November 2022, Optus said it would allocate A$140 million to cover the replacement of compromised identity documents and related remediation costs. CEO Kelly Bayer Rosmarin also publicly apologized as the company sought to address customer fallout.
Optus said it would pay the costs for customers needing to replace foreign passports exposed in the 2022 breach. The move expanded remediation beyond Australian identity documents to affected customers holding overseas passports.
Australia's information commissioner and the Australian Communications and Media Authority launched investigations into the Optus breach in October 2022. The probes added regulatory scrutiny alongside ongoing criminal inquiries.
Following the Optus breach, the Australian government moved to give telecommunications providers authority to share affected customer information with banks. The measure was intended to help financial institutions detect and prevent fraud against customers whose personal data had been exposed.
Police charged a 19-year-old Sydney man for allegedly using data from the Optus breach to blackmail 93 affected customers. The case showed that stolen customer information was already being used in follow-on criminal activity.
Australian state governments announced support for affected residents seeking replacement driver's licences and other identity documents after the breach. The measures were intended to reduce identity theft risks for customers whose official ID numbers were exposed.
Optus began contacting affected customers by email and SMS, warning them about scams and advising that legitimate notices would not contain hyperlinks. The company also offered Equifax Protect and other support to higher-risk customers whose identity document data was exposed.
Within days, the same BreachForums user posted an apology and said the stolen Optus data had been deleted, effectively withdrawing the ransom demand. Optus and the Australian Federal Police did not confirm the authenticity of the claim.
A user claiming to hold the stolen Optus data demanded about US$1 million and threatened to publish batches of records if unpaid. Reports said the extortionist threatened to release tens of thousands of records over several days.
By late September, Cybersecurity Minister Clare O'Neil publicly criticized Optus, calling the incident an unprecedented theft of consumer information and arguing it was not a sophisticated hack. Government agencies began assisting Optus, and officials highlighted regulatory gaps and inadequate penalties for such failures.
Soon after disclosure, Optus described the intrusion as a sophisticated attack, while an alleged attacker, an insider account, and Australian officials said the breach appeared to involve a publicly exposed unauthenticated API and basic security failures. The disagreement became a central part of the public response to the incident.
In September 2022, Optus experienced a breach that exposed personal data of up to 9.8–10 million current and former customers. Exposed information included names, dates of birth, contact details, addresses, and for many victims passport or driver's licence numbers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
15 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourceen.wikipedia.org
Open sourcesmh.com.au
Open sourcesmh.com.au
Open sourcetheguardian.com
Open sourcetherecord.media
Open sourceabc.net.au
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Customer and marketing data from Australian retailer **digiDirect** and New Zealand media company **MediaWorks** was exposed after separate datasets were posted to a popular hacking forum. The digiDirect breach, published in September 2024, contained more than **300,000** rows of personal information, including names, email addresses, physical addresses, phone numbers, and dates of birth. About half of the email addresses were tied to external marketplace domains such as **Amazon**, **eBay**, and **Westfield**, suggesting some affected records may have come from third-party marketplace activity. MediaWorks suffered a larger exposure after a dataset was publicly posted in March 2024 containing millions of rows and **163,000 unique email addresses** linked to people who entered online competitions. The leaked records included names, physical addresses, phone numbers, dates of birth, genders, and competition responses. Following the leak, some victims reportedly received ransom demands seeking payment in exchange for deletion of their stolen data, underscoring the downstream extortion risk created by publicly traded personal data.
Jun 29, 2026
Dutch telecom **Odido** reported that attackers stole data on **6.2 million** current and former customers, while the threat actor claimed the dataset covers **8+ million** people and demanded **€1M+** in ransom, threatening to publish data in daily tranches if unpaid. Reporting indicates the company refused to pay, and the extortionists proceeded with a staged leak strategy intended to maximize public and media impact. Subsequent leak batches reportedly included not only typical customer identifiers (e.g., names, addresses, phone numbers, dates of birth, bank account numbers, and ID numbers) but also **internal customer-service notes** containing highly sensitive context such as stalking, threats, domestic violence, and protected addresses—creating potential **physical safety risks** for affected individuals. The leak cadence was described as multiple dumps over consecutive days (including a “final dump”), drawing significant national attention in the Netherlands and increasing the likelihood of intensified law-enforcement focus on the perpetrators.
Jun 29, 2026
Dutch telecommunications provider **Odido** disclosed a cyberattack in which threat actors gained unauthorized access to a **customer contact/CRM system** and **downloaded personal data** associated with approximately **6.2 million customer accounts**. Odido stated the intrusion was detected over the **February 7–8** weekend and that access was terminated as quickly as possible; the company also reported the incident to the Dutch Data Protection Authority (**Autoriteit Persoonsgegevens**) and engaged external cybersecurity experts to support investigation and additional defensive measures. Odido said its **telecom operations were not disrupted**, and no threat actor group has publicly claimed responsibility; reporting also notes the attackers allegedly contacted Odido to assert they had stolen millions of records. Exposed data varies by customer but may include **full name, address/place of residence, mobile number, customer number, email address, IBAN bank account number, date of birth, and identification document details** (e.g., passport/driver’s license number and validity). Odido emphasized that **passwords** (including for the *My Odido* portal), **call logs**, **location data**, **invoice/billing details**, and **scans of ID documents** were **not** affected. Odido is notifying impacted individuals via email from **`info@mail.odido.nl`** or by SMS, and warned that the stolen data could be used for **impersonation and phishing** attempts that appear to come from Odido.
Jun 29, 2026