On 20 September 2022, Optus detected suspicious activity and confirmed a breach the following day, publicly disclosing it on 22 September. Up to 10 million current and former customers—more than one-third of Australia’s population—had data exposed, including names, birth dates, addresses, telephone numbers, email addresses, passport numbers and driving-licence numbers. Optus later reported that identity documents belonging to 2.1 million customers were stolen, including 1.2 million people whose compromised identification numbers were still valid. The company was required to retain six years of customer data under Australia’s 2015 data-retention law.
Optus described the intrusion as a sophisticated attack, while an alleged insider and Australian officials attributed the exposure to a publicly accessible API vulnerability; the competing accounts were not finally resolved in the supplied record. A ransom demand sought A$1.5 million in Monero, but no ransom was paid and the posted data was later withdrawn. CEO Kelly Bayer Rosmarin apologised, while Cyber Security Minister Clare O’Neil criticised Optus’s security and response. Optus reserved A$140 million for remediation, passport replacements, credit monitoring and an external Deloitte review. The OAIC and ACMA opened investigations on 11 October 2022, and a class action involving about 100,000 customers remained ongoing as of June 2023. Australia subsequently expanded information-sharing powers and considered broader critical-infrastructure cybersecurity reforms.
