Optus, the Australian unit of telecoms firm Singapore Telecommunications said in a statement Thursday it had immediately shut down the attack after discovering it, and that payment details and account passwords had not been compromised.
However, information that may have been exposed include customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver’s license or passport numbers.
Bayer Rosmarin told ABC television the company will contact high-risk customers “quite soon”, and apologized for the incident.
Up to nine million customers may have been affected by the incident.
“Too often we see large scale breaches where payment details and passwords were the only things protected, largely due to regulations like PCI DSS, yet massive amounts of personal data are not,” said Mark Bower, vice president of product management at Anjuna Security. “That’s no longer good enough for maintaining customer trust. The types of data breached in this attack put millions of Australians at risk from phishing, social attack and phone scams which can have huge personal anxiety and financial consequences. Modern enterprises can certainly avoid this with a more holistic approach to data security given the availability of tools that can dramatically reduce impact of insiders or advanced attackers even in a total breach situation which is an inevitable and expected scenario for today’s CISO.”
The company said in a statement following a cyberattack:
“Following a cyberattack, Optus is investigating the possible unauthorized access of current and former customers’ information.
“Upon discovering this, Optus immediately shut down the attack. Optus is working with the Australian Cyber Security Centre to mitigate any risks to customers. Optus has also notified the Australian Federal Police, the Office of the Australian Information Commissioner and key regulators.
“’We are devastated to discover that we have been subject to a cyberattack that has resulted in the disclosure of our customers’ personal information to someone who shouldn’t see it,’ Bayer Rosmarin said.
“’As soon as we knew, we took action to block the attack and began an immediate investigation. While not everyone maybe affected and our investigation is not yet complete, we want all of our customers to be aware of what has happened as soon as possible so that they can increase their vigilance. We are very sorry and understand customers will be concerned. Please be assured that we are working hard, and engaging with all the relevant authorities and organizations, to help safeguard our customers as much as possible.’
“Information which may have been exposed includes customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver’s license or passport numbers. Payment detail and account passwords have not been compromised.
“Optus services, including mobile and home Internet, are not affected, and messages and voice calls have not been compromised. Optus services remain safe to use and operate as per normal.
“Optus has also notified key financial institutions about this matter. While we are not aware of customers having suffered any harm, we encourage customers to have heightened awareness across their accounts, including looking out for unusual or fraudulent activity and any notifications which seem odd or suspicious.”
Click here for more on the Optus advisory.
No further information was immediately available on the type of attack and who was behind it.