View source for 2022 Optus data breach

{{Short description|Australian telecommunications data breach}}
{{Use Australian English|date=May 2023}}
In September 2022, Optus, {{wipe|Australia}}'s third-largest telecommunications company, suffered a data breach, affecting up to 10 million current and former customers, over a third of Australia's population. Information illegally obtained included names, birthdates, home addresses, phone numbers, email contacts, and passport and driving licence numbers. Conflicting claims have been made about how the breach happened; Optus presented it as a complicated attack on their systems, while an Optus insider and the Australian government have claimed that a human error causing a vulnerability in the company's [[API]] occurred. A ransom notice was made, asking for [[Finance:Australian dollar|A$]]1,500,000 to stop the data being sold online. After a few hours, they deleted the ransom notice and apologised for their actions.

Optus has received criticism from government figures, including Home Affairs and Cyber Security Minister Clare O'Neil and Minister for Government Services Bill Shorten, for their role in the attack and for being uncooperative with government agencies and the general public. The government has announced legislation, including allowing information to be shared with financial services and Government agencies, and reforms to Australia's security of critical infrastructure laws, to help the government act for future breaches.<ref name=“:17”>{{Cite news|last=Crozier|first=Ry|date=2022-10-01|title=Australian police, banks join forces to monitor leaked Optus dataset
|language=en-AU|work=itnews|url=https://www.itnews.com.au/news/australian-police-banks-join-forces-to-monitor-leaked-optus-dataset-585938|access-date=2023-10-17|archive-date=2022-09-30|archive-url=https://web.archive.org/web/20220930223430/https://www.itnews.com.au/news/australian-police-banks-join-forces-to-monitor-leaked-optus-dataset-585938|url-status=live}}</ref>

In response to the breach, Optus has agreed to pay for the replacements of passports that have been compromised, commissioned an external review, and given highly affected customers a subscription to a credit monitoring service. Optus has also apologised for the breach. Optus has faced criticism from customers for not being responsive and providing inadequate responses to customers affected. Multiple investigations into the breach and a class-action lawsuit from affected customers are ongoing as of June 2023.

== Background ==
Optus is an Australian telecommunications company, founded in 1981 with the formation of the government-owned AUSSAT, specialising in satellites.<ref>{{Cite web |date=2007-06-08 |title=LOWDOWN - Australia's History in Satellite Technology |url=https://web.archive.org/web/20070608034807/http://www.lowdown.com.au/sat_assat.html |access-date=2024-01-03 |website=web.archive.org}}</ref> AUSSAT was then privatised in 1991 to a consortium of businesses including Mayne Nickless and AMP Limited.<ref>{{Cite web |date=1991-11-20 |title=OPTUS CHOSEN TO TAKE ON TELECOM |url=https://www.afr.com/politics/optus-chosen-to-take-on-telecom-19911120-k4nsp |access-date=2024-01-03 |website=Australian Financial Review |language=en}}</ref> Optus is Australia's third-largest telecommunications company, holding a 13.1% market share.<ref>{{Cite web |last=Bradstock |first=Emma |date=2022-08-18 |title=Largest Internet Providers In Australia {{!}} Plans & Prices |url=https://www.canstarblue.com.au/internet/largest-internet-providers-australia/ |url-status=live |archive-url=https://web.archive.org/web/20230610010050/https://www.canstarblue.com.au/internet/largest-internet-providers-australia/ |archive-date=2023-06-10 |access-date=2023-06-10 |website=Canstar Blue |language=en-US}}</ref> At the time of the breach, Optus had around 10 million customers, well over a third of Australia's population of around 26.64 million.<ref name=":0">{{Cite news |last=Turnbull |first=Tiffanie |date=2022-09-29 |title=Optus: How a massive data breach has exposed Australia |language=en-GB |work=BBC News |url=https://www.bbc.com/news/world-australia-63056838 |url-status=live |access-date=2023-05-16 |archive-url=https://web.archive.org/web/20230516080857/https://www.bbc.com/news/world-australia-63056838 |archive-date=2023-05-16}}</ref><ref>{{Cite web |date=2023-12-14 |title=National, state and territory population, June 2023 {{!}} Australian Bureau of Statistics |url=https://www.abs.gov.au/statistics/people/population/national-state-and-territory-population/latest-release |access-date=2024-01-03 |website=www.abs.gov.au |language=en}}</ref>

== Breach ==
On 20 September, Optus's technical team noticed and investigated suspicious activity on its network. The next day, it was identified that Optus's systems had sustained a data breach, and regulators were informed. On 22 September, the company went public with the data breach, informing news agencies.<ref name=":0" /><ref>{{Cite web |last=Smith |first=Paul |date=2022-12-21 |title=Inside the Optus hack that woke up Australia |url=https://www.afr.com/technology/inside-the-optus-hack-that-woke-up-australia-20221123-p5c0lm |access-date=2023-05-20 |website=Australian Financial Review |language=en |archive-date=2023-05-20 |archive-url=https://web.archive.org/web/20230520033909/https://www.afr.com/technology/inside-the-optus-hack-that-woke-up-australia-20221123-p5c0lm |url-status=live }}</ref> Optus recommended that people increase attention to potential fraudulent activity, but stated that they did not know if the breach had caused any harm to customers. At this point, Optus did not state how many customers were affected, nor if the data taken had caused harm.<ref name=":6">{{Cite news |last=McElroy |first=Nicholas |date=2022-09-22 |title=Optus says customer information compromised in cyber attack |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-09-22/optus-hit-with-cyber-attack-impacting-customers-/101466036 |access-date=2023-05-16 |archive-date=2022-09-23 |archive-url=https://web.archive.org/web/20220923031909/https://www.abc.net.au/news/2022-09-22/optus-hit-with-cyber-attack-impacting-customers-/101466036 |url-status=live }}</ref> Information illegally obtained included names, birthdates, home addresses, phone numbers, email contacts, and passport and driving licence numbers.<ref name=":0" /> 

[[File:2022 Optus data breach ransom note.png|thumb|404x404px|Ransom note left by the person believed to be behind the breach|alt=Screenshot of the ransom note. ]]
On 23 September, Optus denied claims made by an insider that a mistake had occurred where Optus's API had accidentally been left exposed to a test network that had internet access. They instead claimed a complicated breach had occurred, and that the company had a strong cybersecurity system.<ref name=":9">{{Cite news |date=2022-09-23 |title=Optus rejects insider claims of 'human error' as possible factor in hack affecting millions of Australians |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-09-23/optus-rejects-claim-hack-likely-result-of-human-error/101468846 |access-date=2023-05-16 |archive-date=2022-09-24 |archive-url=https://web.archive.org/web/20220924055906/https://www.abc.net.au/news/2022-09-23/optus-rejects-claim-hack-likely-result-of-human-error/101468846 |url-status=live }}</ref> The Australian Broadcasting Corporation was told that Optus believed the hacker had scraped the company's consumer database, with only a third of the total data in the database copied and extracted.<ref name=":9"/>

On 24 September, Optus and the Australian Federal Police (AFP), now having opened a criminal investigation, received reports that data from the leak was being sold online, and were monitoring the [[Dark web|dark web]] for any attempt of selling data online.<ref>{{Cite news |last=Belot |first=Henry |date=2022-09-24 |title=AFP monitoring dark web amid allegations stolen Optus data may be sold online |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-09-24/afp-monitoring-dark-web-for-stolen-optus-data-sold-online/101471256 |access-date=2023-05-16 |archive-date=2023-05-18 |archive-url=https://web.archive.org/web/20230518215014/https://www.abc.net.au/news/2022-09-24/afp-monitoring-dark-web-for-stolen-optus-data-sold-online/101471256 |url-status=live }}</ref> The same day, a user on BreachForums posted a ransom note believed to be legitimate by some cybersecurity experts but unconfirmed by Optus and the AFP, demanding that Optus pay $1,500,000 in privacy-focused cryptocurrency [[Monero]]. They said that they would release the personal information of 10,000 customers every day that Optus did not pay the ransom until a week elapsed, with a sample of the information of 200 customers. After the week elapsed, they were to sell the data for A$400,000 to anyone who wants it.<ref name=":1">{{Cite news |date=2022-09-27 |title=An alleged hacker has offered their 'deepest apologies' to Optus. Here's the latest on the data breach |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-09-27/optus-data-breach-cyber-attack-hacker-ransom-sorry/101476316 |access-date=2023-05-16 |archive-date=2022-10-03 |archive-url=https://web.archive.org/web/20221003092203/https://www.abc.net.au/news/2022-09-27/optus-data-breach-cyber-attack-hacker-ransom-sorry/101476316 |url-status=live }}</ref> After a few hours, the user deleted their original post and appeared to apologise for their actions despite no ransom being paid, stating that it was a "mistake to scrape publish [sic] data in first place"<ref name=":1" /> and that there were too many people paying attention to the breach. The user noted that they would have reported the exploit that they used if they had the ability to contact Optus, noting the lack of a secure mail/messaging contact or [[Bug bounty program|bug bounties]].<ref name=":1" />

== Government response ==
Home Affairs and Cyber Security Minister Clare O'Neil alleged that Optus was at fault for the attack, refuting Optus's argument that the attack was complicated. O'Neil also stated that the attack should not have happened, stating: "Responsibility for the security breach rests with Optus[,] and I want to note that the breach is of a nature that we should not expect to see in a large telecommunications provider in this country".<ref name=":10">{{Cite news |last=Evans |first=Jake |date=2022-09-26 |title=Home affairs minister says Optus 'left window open' for cyber criminals |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-09-26/home-affairs-minister-blames-optus-for-cyber-attack-hack/101474636 |access-date=2023-05-16 |archive-date=2022-09-27 |archive-url=https://web.archive.org/web/20220927014744/https://www.abc.net.au/news/2022-09-26/home-affairs-minister-blames-optus-for-cyber-attack-hack/101474636 |url-status=live }}</ref>

The federal government announced emergency regulation on 6 October so that drivers licences, Medicare information and passport numbers can be temporarily shared with financial services, the Commonwealth, and state or territory agencies to assist with monitoring the accounts of customers affected by the breach for potential scams or fraud. Financial institutions will have to commit to several actions to receive the data, including honouring privacy obligations and deleting data once it has been used. The Council of Financial Regulators have also been asked to identify and report on changes for financial instructions to identify customers who are at risk of scams and fraud. The changes will be in place for 12 months. Treasurer Jim Chalmers stated that the measures will help protect customers from scams, and to detect fraud.<ref name=":12">{{Cite news |last=Evans |first=Jake |date=2022-10-06 |title=Optus given temporary power to share compromised data with banks following hack |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-10-06/optus-given-power-to-share-data-with-banks-following-breach/101507396 |access-date=2023-05-17 |archive-date=2022-10-09 |archive-url=https://web.archive.org/web/20221009011318/https://www.abc.net.au/news/2022-10-06/optus-given-power-to-share-data-with-banks-following-breach/101507396 |url-status=live }}</ref>

O'Neil expressed frustration at the lack of ability for the government to intervene in the data breach, with the government being unable to assist with the clean-up following the breach, or compel Optus to give government services information. She stated that Australian law had no use for the government when needed, as Australia's security of critical infrastructure laws only allowed the government to legally intervene while a data breach was occurring.<ref name=":5" />

Several new security measures have been announced following the breach to protect victims from fraud, including banks being informed of data breaches faster to prevent the use of data to fraudulently access bank accounts.<ref name=":11">{{Cite news |last1=Speers |first1=David |last2=Greene |first2=Andrew |date=2022-09-28 |title=Federal government to unveil new security measures following massive Optus data breach |work=ABC News |url=https://www.abc.net.au/news/2022-09-25/new-security-measures-to-be-unveiled-following-optus-data-breach/101472364 |access-date=2023-05-17 |archive-date=2023-05-17 |archive-url=https://web.archive.org/web/20230517074653/https://www.abc.net.au/news/2022-09-25/new-security-measures-to-be-unveiled-following-optus-data-breach/101472364 |url-status=live }}</ref> The federal government has also flagged an overhaul of the $1.7 billion cybersecurity plan introduced by the previous government, including additional powers for the government to intervene regarding cybersecurity. The government is also considering a Cyber Security Act to create standards and obligations for industry and government, and a reform to the Security of Critical Infrastructure Act to bring customer data and systems under the definition of "critical infrastructure" allowing the government to intervene in major data breaches.<ref name=":4">{{Cite news |last=Evans |first=Jake |date=2023-02-26 |title=Federal government to rewrite cyber laws after Optus, Medibank hacks |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2023-02-27/national-cyber-office-to-be-established-in-wake-of-optus-hack/102026156 |access-date=2023-05-17 |archive-date=2023-05-17 |archive-url=https://web.archive.org/web/20230517074651/https://www.abc.net.au/news/2023-02-27/national-cyber-office-to-be-established-in-wake-of-optus-hack/102026156 |url-status=live }}</ref>

In April 2023, the National Office of Cyber Security was founded, albeit with 5 full-time staff members and no additional funding than what was already given to the Department of Home Affairs.<ref>{{Cite web |title=Govt fires up National Cyber Security Office |url=https://ia.acs.org.au/article/2023/govt-fires-up-national-cyber-security-office.html |access-date=2024-01-03 |website=Information Age}}</ref> In June 2023, Air Marshal Darren Goldie was appointed as Australia's inaugural Cyber Security Coordinator.<ref>{{Cite web |last=ACSM Admin |date=2023-06-23 |title=Australia’s New National Cyber Security Coordinator - Australian Cyber Security Magazine |url=https://australiancybersecuritymagazine.com.au/australias-new-national-cyber-security-coordinator/ |access-date=2024-01-03 |language=en-US}}</ref> In November 2023, Goldie was recalled to the Department of Defence regarding a workplace matter, with cyber and infrastructure security head Hamish Hansford to take on the position in the interim.<ref>{{Cite web |last=Bajkowski |first=Julian |date=2023-11-15 |title=O’Neil’s National Cybersecurity Coordinator sent back to Defence |url=https://www.themandarin.com.au/234849-oneils-national-cybersecurity-coordinator-sent-back-to-defence/ |access-date=2024-01-03 |website=The Mandarin |language=en-US}}</ref> 

On 27 February 2023, Prime Minister Anthony Albanese and O'Neil hosted a roundtable with industry and civil society groups on cybersecurity following the data breach. A discussion paper was released regarding the role of the federal government in increasing Australia's cybersecurity capability.<ref name=":4" /><ref>{{Cite web |last=Foster |first=Jeffrey |date=2023-02-28 |title=Australia has a new cybersecurity agenda. Two key questions lie at its heart |url=http://theconversation.com/australia-has-a-new-cybersecurity-agenda-two-key-questions-lie-at-its-heart-200714 |access-date=2023-05-19 |website=The Conversation |language=en |archive-date=2023-05-19 |archive-url=https://web.archive.org/web/20230519075427/http://theconversation.com/australia-has-a-new-cybersecurity-agenda-two-key-questions-lie-at-its-heart-200714 |url-status=live }}</ref> 

The state governments of Queensland, Victoria, South Australia and Western Australia have agreed to pay for the replacement of driver's licenses for people that had their driver's license number compromised by the breach.<ref>{{Cite web |title=Optus data breach: What to do about replacing your driver's licence and passport |url=https://www.sbs.com.au/news/article/optus-data-breach-what-to-do-about-replacing-your-drivers-licence-and-passport/1ifnlrd2p |access-date=2023-05-20 |website=SBS News |language=en |archive-date=2023-05-20 |archive-url=https://web.archive.org/web/20230520041443/https://www.sbs.com.au/news/article/optus-data-breach-what-to-do-about-replacing-your-drivers-licence-and-passport/1ifnlrd2p |url-status=live }}</ref><ref>{{Cite web |last=Cowie |first=Tom |date=2022-10-29 |title=VicRoads to issue almost 1 million free driver's licences after Optus hack |url=https://www.theage.com.au/national/victoria/vicroads-to-issue-almost-1-million-free-driver-licences-after-optus-hack-20221029-p5bu08.html |access-date=2023-05-20 |website=The Age |language=en |archive-date=2023-05-20 |archive-url=https://web.archive.org/web/20230520041447/https://www.theage.com.au/national/victoria/vicroads-to-issue-almost-1-million-free-driver-licences-after-optus-hack-20221029-p5bu08.html |url-status=live }}</ref> In Victoria, plans to add a second number to driver's licenses was fast-tracked, with all victims of the breach receiving the second number as part of their replacements, with the intention of protecting Victorians from [[Identity theft|identity theft]].<ref>{{Cite web |last=Cowie |first=Tom |date=2022-10-29 |title=VicRoads to issue almost 1 million free driver's licences after Optus hack |url=https://www.theage.com.au/national/victoria/vicroads-to-issue-almost-1-million-free-driver-licences-after-optus-hack-20221029-p5bu08.html |access-date=2023-06-15 |website=The Age |language=en |archive-date=2023-06-03 |archive-url=https://web.archive.org/web/20230603103929/https://www.theage.com.au/national/victoria/vicroads-to-issue-almost-1-million-free-driver-licences-after-optus-hack-20221029-p5bu08.html |url-status=live }}</ref>

== Optus response ==
[[File:Optus Macquarie Park - panorama.jpg|thumb|498x498px|Optus's headquarters at Macquarie Park, where the "war room" was located|alt=Group of buildings photographed from a large courtyard. ]]
On the day that the breach was announced, Optus set up a "war room" to deal with the breach at its headquarters in Macquarie Park. This involved around 150 employees and was headed by former Premier of New South Wales Gladys Berejiklian and regulatory and public affairs head Andrew Sheridan.<ref>{{Cite web |last=Smith |first=Paul |date=2022-12-21 |title=Inside the Optus hack that woke up Australia |url=https://www.afr.com/technology/inside-the-optus-hack-that-woke-up-australia-20221123-p5c0lm |access-date=2023-05-20 |website=Australian Financial Review |language=en |archive-date=2023-05-20 |archive-url=https://web.archive.org/web/20230520033909/https://www.afr.com/technology/inside-the-optus-hack-that-woke-up-australia-20221123-p5c0lm |url-status=live }}</ref> 

Optus commissioned [[Company:Deloitte|Deloitte]] to do an "independent external review" regarding the breach.<ref name=":2">{{Cite web |last=Branco |first=Jorge |date=2022-10-26 |title=Privacy watchdog given $5.5 million to investigate Optus cyber breach |url=https://www.9news.com.au/national/federal-budget-2022-optus-hack--oaic-given-55-million-to-investigate-telco-cyber-breach/d0f7fee4-e59f-4f2e-906c-ddb31ba78429 |access-date=2023-05-18 |website=www.9news.com.au |archive-date=2023-05-18 |archive-url=https://web.archive.org/web/20230518080348/https://www.9news.com.au/national/federal-budget-2022-optus-hack--oaic-given-55-million-to-investigate-telco-cyber-breach/d0f7fee4-e59f-4f2e-906c-ddb31ba78429 |url-status=live }}</ref> Optus also signed up its "most affected" customers to get a 12-month subscription to credit monitoring service Equifax Protect after O'Neil requested the company buy credit monitoring for its customers in Question Time.<ref name=":3">{{Cite news |last=Taylor |first=Josh |date=2022-09-26 |title=Optus customers exasperated by chatbots and 'rubbish' communication after data breach |language=en-GB |work=The Guardian |url=https://www.theguardian.com/business/2022/sep/27/optus-customers-exasperated-by-chatbots-and-rubbish-communication-after-data-breach |access-date=2023-05-18 |issn=0261-3077 |archive-date=2023-05-18 |archive-url=https://web.archive.org/web/20230518080346/https://www.theguardian.com/business/2022/sep/27/optus-customers-exasperated-by-chatbots-and-rubbish-communication-after-data-breach |url-status=live }}</ref> Optus CEO Kelly Bayer Rosmarin deeply apologised for the attack on behalf of the company.<ref name=":7" /> Optus has put aside $140 million for costs relating to the breach, including to replace hacked identification documents, the Equifax Protect subscriptions and the Deloitte review.<ref name=":7">{{Cite web |last=Samios |first=Zoe |date=2022-11-10 |title=Optus hack to cost at least $140 million |url=https://www.smh.com.au/business/companies/optus-puts-aside-140m-to-replace-customers-hacked-identity-documents-20221110-p5bx4g.html |access-date=2023-05-18 |website=The Sydney Morning Herald |language=en |archive-date=2022-11-13 |archive-url=https://web.archive.org/web/20221113101133/https://www.smh.com.au/business/companies/optus-puts-aside-140m-to-replace-customers-hacked-identity-documents-20221110-p5bx4g.html |url-status=live }}</ref> Optus has promised to pay for the replacement of Australian and foreign passports that have been compromised in the breach.<ref name=":13">{{Cite news |last1=Conifer |first1=Dan |last2=Xiao |first2=Alison |last3=Bogle |first3=Ariel |date=2022-11-03 |title=Optus promises to pay cost of replacing foreign passports compromised in data breach |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-11-03/optus-replace-foreign-passports-data-breach/101604176 |access-date=2023-05-20 |archive-date=2022-11-03 |archive-url=https://web.archive.org/web/20221103112915/https://www.abc.net.au/news/2022-11-03/optus-replace-foreign-passports-data-breach/101604176 |url-status=live }}</ref>

Optus reported that 2.1 million of its customers had had identity documents stolen as part of the hack. Of these, 1.2 million customers, according to Optus, had at least one current, valid number from a form of personal identification stolen. The remaining 900,000 customers had expired identity numbers stolen.<ref>{{Cite web |last=Crozier |first=Ry |title=Deloitte brought in to examine Optus data breach |url=https://www.itnews.com.au/news/deloitte-brought-in-to-examine-optus-data-breach-585966 |access-date=2023-05-18 |website=iTnews |archive-date=2023-05-18 |archive-url=https://web.archive.org/web/20230518080351/https://www.itnews.com.au/news/deloitte-brought-in-to-examine-optus-data-breach-585966 |url-status=live }}</ref> 

Allegations of a lack of communication from Optus have been made by Services Australia. On 27 September, Services Australia wrote to Optus “asking for the full details of all affected customers with Services Australia credentials exposed, such as Medicare cards and/or Centrelink concession cards”.<ref name=":5" /> Minister for Government Services Bill Shorten stated that, a week later, Services Australia had not received any data from Optus. Optus claimed that they were "in contact with Services Australia and we will be letting all affected customers know the guidance on the steps they can take".<ref name=":5" /> There was also confusion regarding the number of Medicare ID numbers stolen, with Shorten telling a press conference that around 36,900 ID numbers had been stolen, and Optus identifying that 14,900 ID numbers had been stolen.<ref name=":5">{{Cite web |last=Crozier |first=Ry |title=Services Australia struggles to gauge exposure to Optus data breach |url=https://www.itnews.com.au/news/services-australia-struggles-to-gauge-exposure-to-optus-data-breach-585944 |access-date=2023-05-18 |website=iTnews |archive-date=2023-05-18 |archive-url=https://web.archive.org/web/20230518080353/https://www.itnews.com.au/news/services-australia-struggles-to-gauge-exposure-to-optus-data-breach-585944 |url-status=live }}</ref>

Customers have also reported issues regarding communicating with the company. Customers stated that Optus could not confirm if their personal information was part of the data breach after contacting them several times, the company's chatbot failing to understand questions from customers about the breach, poor responses from sales representatives, not receiving a response from Optus at all, and delays in warning customers regarding compromises of personal information. A customer stated that, "Ultimately, we are sitting ducks for identity theft, and given that we can’t change our dates of birth, address or names, there isn’t much we can do about it, which is incredibly frustrating".<ref name=":3" />

On 8 March 2023, Bayer Rosmarin restated Optus's claim that the attack was sophisticated, stating at a business summit that “The skilled criminal had knowledge of Optus’ systems and cycled through many tens of thousands of internet protocol addresses in an attempt to evade our automated cyber monitoring”.<ref name=":8" /> She also stated that Optus never paid a ransom to the hacker, and that the primary reason for the breach was for other scam purposes.<ref name=":8">{{Cite web |last=Muroi |first=Millie |date=2023-03-08 |title=Optus boss says 'skilled criminal' behind cyberattack, admits telco lost customers |url=https://www.smh.com.au/business/companies/optus-boss-says-skilled-criminal-behind-cyberattack-admits-telco-lost-customers-20230308-p5cqf9.html |access-date=2023-05-20 |website=The Sydney Morning Herald |language=en |archive-date=2023-05-20 |archive-url=https://web.archive.org/web/20230520033908/https://www.smh.com.au/business/companies/optus-boss-says-skilled-criminal-behind-cyberattack-admits-telco-lost-customers-20230308-p5cqf9.html |url-status=live }}</ref>

In November 2023, Bayer Rosmarin resigned as CEO of Optus after the 2023 Optus outage following mounting pressure to resign due to the outage and the date breach.<ref>{{Cite web |last=Swan |first=David |date=2023-11-20 |title=Optus CEO Kelly Bayer Rosmarin resigns |url=https://www.smh.com.au/business/companies/optus-ceo-kelly-bayer-rosmarin-resigns-20231117-p5ekw8.html |access-date=2024-01-03 |website=The Sydney Morning Herald |language=en}}</ref>

== Legal action ==
On 6 October, a 19-year-old Sydney man, Dennis Su, was arrested by the AFP in his home at Rockdale for blackmailing 93 Optus customers affected by the breach. He claimed that he would commit financial crimes using their personal data unless they paid A$2000 to him, which none did. He was charged with a count of using a telecommunication network with intent to commit a serious offence and a count of dealing with identification information with intent to commit an offence. AFP Assistant Commissioner Justine Gough stated that he was not suspected of being responsible for the breach, and warned people to not click on links claiming to be from Optus.<ref>{{Cite news |last=Lapham |first=Jake |date=2022-10-06 |title=Sydney teen demanded $2,000 from Optus customers as part of data breach scam, AFP says |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-10-06/sydney-19-year-old-man-charged-alleged-use-optus-data-/101508404 |access-date=2023-05-17 |archive-date=2022-10-06 |archive-url=https://web.archive.org/web/20221006115935/https://www.abc.net.au/news/2022-10-06/sydney-19-year-old-man-charged-alleged-use-optus-data-/101508404 |url-status=live }}</ref> Su pleaded guilty in November 2022. He did not go to jail due to a guilty pleading, his age and showing remorse for his actions, instead receiving an 18-month community corrections order.<ref>{{Cite web |date=2023-02-07 |title=Sydney man avoids jail over scam texts using Optus hack data |url=https://www.9news.com.au/national/teen-dennis-su-scammer-avoids-jail-after-text-messages-court-sydney-new-south-wales/b3fa1cf1-1a68-4063-8087-b0882e8b990f |access-date=2023-05-20 |website=www.9news.com.au |archive-date=2023-05-20 |archive-url=https://web.archive.org/web/20230520033906/https://www.9news.com.au/national/teen-dennis-su-scammer-avoids-jail-after-text-messages-court-sydney-new-south-wales/b3fa1cf1-1a68-4063-8087-b0882e8b990f |url-status=live }}</ref>

The Office of the Australian Information Commissioner (OAIC) has launched an investigation into the breach, concerning Optus's handling of the personal data of customers, focusing on whether Optus took reasonable steps to protect consumers affected by the breach from fraud, misuse, or loss, and whether the information collected was necessary for Optus to keep. Australian Communications and Media Authority is also investigating the breach, focusing on whether Optus breached its obligations regarding the protection and disposal of personal data.<ref name=":14">{{Cite news |last=Borys |first=Stephanie |date=2022-10-11 |title=Optus facing new probes over data hack, could be forced to pay millions in compensation |language=en-AU |work=ABC News |url=https://www.abc.net.au/news/2022-10-11/information-commissioner-acma-investigate-optus-data-hack/101522800 |access-date=2023-05-17 |archive-date=2022-10-13 |archive-url=https://web.archive.org/web/20221013121942/https://www.abc.net.au/news/2022-10-11/information-commissioner-acma-investigate-optus-data-hack/101522800 |url-status=live }}</ref> OAIC was given $5.5 million to investigate the breach over two years by the federal government in its October 2022 budget.<ref name=":2" />

A class action has been launched by law firm Slater & Gordon, alleging Optus "breached laws and its own policies by failing to adequately protect customer data and destroy or de-identify former customer data". The ongoing class action has been joined by 100,000 current and former customers, wanting compensation for losses, including the time to replace identification documents, and the stress caused. Optus has stated it will defend its actions.<ref name=":15">{{Cite news |last=Jackson |first=Lewis |date=2023-04-21 |title=Australia's Optus hit with class action over cybersecurity breach |language=en |work={{wipe|Reuters}} |editor-last=Osterman |editor-first=Cynthia |url=https://www.reuters.com/business/media-telecom/australias-optus-hit-with-class-action-over-cybersecurity-breach-2023-04-20/ |access-date=2023-05-17 |archive-date=2023-05-17 |archive-url=https://web.archive.org/web/20230517074651/https://www.reuters.com/business/media-telecom/australias-optus-hit-with-class-action-over-cybersecurity-breach-2023-04-20/ |url-status=live }}</ref><ref>{{Cite web |last=Bonyhady |first=Nick |last2=Abbott |first2=Lachlan |date=2023-04-20 |title=Class action lawsuit launched against Optus after devastating hack |url=https://www.smh.com.au/business/companies/class-action-lawsuit-launched-against-optus-after-devastating-hack-20230421-p5d26n.html |url-status=live |archive-url=https://web.archive.org/web/20230520020506/https://www.smh.com.au/business/companies/class-action-lawsuit-launched-against-optus-after-devastating-hack-20230421-p5d26n.html |archive-date=2023-05-20 |access-date=2023-05-20 |website=The Sydney Morning Herald |language=en}}</ref> In court, Slater & Gordon lawyers requested that the Deloitte report be released to the public, arguing that it could reveal the possible causes for the data breach. Optus declined to do so, despite Bayer Rosmarin stating in March 2023 that Optus would release "share key recommendations and learnings"<ref name=":16">{{Cite web |last=Baird |first=Lucas |date=2023-03-08 |title=‘No victims’ of Optus data hack: CEO |url=https://www.afr.com/business-summit/no-victims-of-optus-data-hack-ceo-20230308-p5cqfg |access-date=2023-10-04 |website=Australian Financial Review |language=en}}</ref> from the report.<ref name=":16" /><ref>{{Cite news |last=Tarabay |first=Jamie |date=2023-09-20 |title=Massive Australian Ransomware Attack Has Victims Demanding Answers |language=en |work=Bloomberg.com |url=https://www.bloomberg.com/news/newsletters/2023-09-20/massive-australian-ransomware-attack-has-victims-demanding-answers |access-date=2023-10-04}}</ref>

== See also ==
* 2023 Optus outage
* Telecommunications in Australia

== References ==
{{Reflist}}

[[Category:Data breaches]]

{{Sourceattribution|2022 Optus data breach}}