Cyber Incident Victim: Optus
Date:
Sep 2022
Location:
Australia
Summary
A major Australian telecommunications provider suffered a cyberattack resulting in unauthorized access to current and former customer data, including names, dates of birth, contact details, addresses, and identity document numbers such as driver's licenses or passports. The company, serving approximately 10 million customers, stated the incident had concluded and notified national cybersecurity authorities. This breach aligns with broader targeting patterns against telecom infrastructure globally, where attackers exploit such data for espionage or criminal activities like social engineering and SIM-swapping schemes. The event follows similar historical compromises affecting other large telecom operators internationally involving substantial customer data theft and source code breaches.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 22, 2022, Optus, Australia’s second-largest telecommunications provider with approximately 10 million customers, publicly disclosed a significant data breach affecting current and former customers. The Singapore-owned subsidiary of Singtel confirmed unauthorized access to customer data, including names, dates of birth, phone numbers, email addresses, physical addresses, and identity document numbers such as driver’s licenses or passports. Optus did not specify the exact number of affected individuals or the precise timeframe of the breach but stated the incident had concluded by the time of disclosure. The company initiated notifications to regulatory bodies, including the Australian Signals Directorate (ASD), the nation’s signals intelligence agency comparable to the U.S. National Security Agency. No technical details regarding the attack vector, intrusion methods, or compromised systems were disclosed in the initial announcement.
The breach highlighted the persistent targeting of telecommunications infrastructure by both state-sponsored and criminal threat actors. Telecom providers like Optus manage vast troves of sensitive customer data, making them attractive targets for espionage, identity theft, and financial fraud. Historical precedents cited in the disclosure context included the 2015 breach of Telstra-owned undersea cable operator Pacnet, where attackers maintained prolonged access to email and business systems, and multiple T-Mobile breaches in the U.S., including a 2022 incident involving the theft of source code by the Lapsus$ cybercrime group. Optus’s incident underscored operational risks inherent to the sector, particularly the exposure of identity documents, which could facilitate follow-on attacks such as SIM-swapping or credential stuffing. The company’s public confirmation focused on factual details of the compromised data types and regulatory notifications, avoiding speculation on attribution or long-term mitigation strategies.