In today’s world, businesses around the world as well as in Australia face increasingly sophisticated and innovative cybercriminals targeting what matters most to them: their money, data and reputation. In September 2022, Optus fell victim to a major cyberattack. Here is everything you need to know about it, as well as nine steps every Australian business needs to take to avoid being next.
Optus Data Breach: Everything You Need to Know
What happened?
Optus suffered a massive cyberattack in which cybercriminals accessed the personal information of millions of its current and former customers. The Australian Information Commissioner estimates that approximately 9.5 million Australians were affected. The exposed details included names, dates of birth, home addresses, phone numbers and email addresses, along with government-issued identification numbers such as driver’s licence and passport numbers for some customers.
How did the attack happen?
Early reports indicated that the attacker reached Optus’s customer identity database through an application programming interface (API) that did not require any authentication, so anyone who knew it existed could request customer records over the internet.
Legal action by the Australian Communications and Media Authority (ACMA), filed in May 2024, later gave more detail. The ACMA alleges that a coding error introduced in a 2018 update weakened an access control and that, although Optus identified the problem on its main website in 2021, a second internet-facing domain remained exposed until the attack.
Although Optus maintained at the time that it was the victim of a sophisticated cyberattack, the then Minister for Home Affairs, Clare O’Neil, compared the vulnerability that allowed Optus to be attacked to leaving a window open.
Who was responsible?
Soon after the Optus data breach went public, an individual came forward on a data breach forum claiming to have the data stolen from Optus. The individual, known as ‘Optusdata’, initially threatened to sell the sensitive data unless Optus paid a ransom of US$1 million. The user then posted 10,000 customer records on the forum, but within a day deleted the post and apologised. At the time, neither Optus nor the Australian Federal Police had verified these claims.
What is the impact on Optus?
An attack of this size can be devastating for any organisation. Optus has faced financial costs and serious reputational damage, with existing and potential customers able to take their business to competitors, alongside the cost of fixing its cybersecurity and supporting affected customers.
It has also faced regulatory action. The ACMA began Federal Court proceedings in May 2024, and in August 2025 the Australian Information Commissioner filed civil penalty proceedings alleging that Optus seriously interfered with the privacy of approximately 9.5 million Australians. Neither case had been decided at the time of writing.
If we are to draw from cyberattacks in the past:
- T-Mobile (2021) – the US telecommunications company agreed in July 2022 to pay US$350 million to settle a class action over its data breach, and to spend an additional US$150 million on data security and related technology in 2022 and 2023.
- Sony Pictures (2014) – after a cyberattack on the company, Sony agreed in 2015 to pay up to US$8 million to settle a lawsuit brought by current and former employees, covering identity theft losses and identity protection services.
What is the impact on Optus’ customers?
For current and former customers, the sensitive data exposed by the breach could be distributed on the dark web, allowing cybercriminals to use it to commit identity theft and fraudulent credit applications or to carry out more targeted phishing campaigns.
Former and current customers of Optus need to stay vigilant and avoid clicking on any links in emails unless their legitimacy has been validated. They also need to keep an eye out for signs that their data has been compromised.
Nine Steps Australian Businesses Need to Take Now
Now that you have an overview of the Optus data breach, here are nine steps your business needs to take to avoid being a victim of a similar cyberattack:
Understand and assess your cyber risk
One of the first steps Australian businesses need to take is to understand their cyber risk. In simple terms, cyber risk is the risk of potentially negative consequences due to your business’s information systems failing or being disrupted, damaged or destroyed by a malicious individual via unauthorised access.
By understanding cyber risk, businesses can gain better knowledge on how to protect all of their assets, as well as their sensitive and protected data. In addition, it also helps with compliance, as many standards require a level of cyber risk management. Understanding where you have cyber risks is also essential in determining how to best prepare your business in the event of a cyberattack or data breach.
It is important to note that assessing cyber risk is not something that should be performed once; your Information Security teams need to continuously monitor and assess cyber risk as your business grows and cyber threats evolve.
Ensure your APIs are secured
An API is an application programming interface, which means an interface to exchange information from one application to another. It has been widely used since the advent of web-based applications to avoid the need for manually pulling data from one application to another. These interfaces sit within the application’s architecture and should be designed to give access only to authorised users to interface and exchange information.
In the instance of the Optus data breach, it appears the API could be reached by anyone who knew the address. These individuals would then be able to access the customer data stored within without any kind of authentication or authorisation. Australian businesses need to learn from this and ensure that APIs are secured appropriately, e.g. with access controls for authentication and authorisation, data encryption, firewalls and the application of rate limiting. Our guide to API security best practices covers these controls in more detail.
Train and build awareness around cybersecurity
Humans are the weakest link in a business’s defences; one click of a link in an email by an employee can give cybercriminals access to your entire critical systems and networks. Security awareness training is a strategy every business should use to prevent and reduce the risk of its information security being compromised. Good programs make it clear to employees what their roles and responsibilities are in keeping information secure.
A successful program teaches employees safe online habits, shows them how their own actions can create security risks, and helps them recognise the cyberattacks they are likely to meet in their daily work. Human error continues to be one of the biggest threats to a business’s information security. By providing employees with thorough and regular training and awareness when it comes to information security, businesses can greatly reduce the chance of cyberattacks and instil a strong cybersecurity culture within their organisation.
Implement access controls
All Australian businesses need to implement access controls to ensure that only authorised employees can access sensitive data and systems. Giving each employee only the level of access their role and responsibilities require limits the damage a cyberattack can do, whether it comes from an external actor or an internal error. It is also essential to have appropriate steps in place to revoke access when an employee leaves the business.
A practical way to put access control into practice is the principle of least privilege: every user, account, application, system, device and process receives only the access rights and permissions it needs for its assigned tasks, and nothing more. This also reduces the risk of an ‘insider’ accidentally or maliciously endangering your business.
Ensure your software is regularly updated
Cybercriminals take advantage of known vulnerabilities to hack your devices. Regular system updates have comprehensive security upgrades to patch these vulnerabilities. Ensuring that employees are installing the latest patches and updates to the software can help reduce the chance that a cybercriminal exploits a known weakness to gain access to your system or network. A good way to stay on top of updates is to turn on the automatic update function on software and systems; however, if this isn’t available it is the employee’s responsibility to check for updates regularly. Patching applications and operating systems are both part of ASD’s Essential Eight.
Evaluate third-party risk
Third-party risk is the potential threat that vendors, suppliers and other outside parties with access to your systems pose to your employee and customer data, financial information and operations. Do your due diligence before partnering with a vendor, for example by confirming it has adequate information security policies in place, and keep checking that it upholds those standards while handling your data.
Maintain data backups
A backup is a digital copy of your business’s most important information, e.g. customer details and financial records. This can be saved to an external storage device or to the cloud. An automatic backup is the default or ‘set and forget’ system that backs up your data automatically, without human intervention. Backups are important because data losses can occur in many forms, from hard drive failures to ransomware attacks and even human error or physical theft. Regardless of the incident, a data backup could enable you to restore the data stored on your devices. Data backups can greatly reduce the downtime a business could face in the event of a ransomware attack.
Enforce multi-factor authentication and password management
Businesses should ensure that employees implement two or multi-factor authentication on their devices. Implementing multi-factor authentication such as two-factor authentication, which needs another factor other than username and password to enable access, can increase the chances of preventing endpoint access.
Businesses also need to encourage strong password management practices amongst employees, ensuring that passwords are long, complex and unique, are not shared amongst accounts, and are changed promptly if they may have been compromised. Strong password management is an essential part of endpoint security; if an attacker gets access to login credentials, strong password management can lessen the impact, e.g. if passwords are unique and not reused, attacker access can be restricted to a single account.
Ensure you have an incident response plan
Organisations that suffer a cyberattack usually are not aware of the presence of a malicious actor until it is too late, or security teams within organisations don’t take appropriate action as soon as a threat is identified, either downplaying the severity of the attack or ignoring it entirely.
Incident response plans help organisations and their various departments and employees aptly respond to threats. A strong IR plan sets out roles and responsibilities, communication plans and standardised response protocols. This gives everyone a clear procedure to follow when an incident happens, helping to reduce downtime, financial impact and reputational damage.
How Can StickmanCyber Help?
Cybersecurity can feel overwhelming for business owners, particularly small and medium businesses working with a limited budget. Building a cybersecurity strategy means deciding which framework to follow and what to prioritise first, and StickmanCyber can support you at every stage of that journey.
Many businesses lack the in-house skills and time to keep on top of their cyber risk. Our fully managed cybersecurity and compliance services help you reduce that risk, build trust with your customers, and win and retain clients. Speak to an expert today to learn more about how you can protect your business.
Not sure where your business stands? Begin with a cybersecurity assessment.
An assessment reviews how well your business is protected today and pinpoints the gaps and challenges to act on first. Start an assessment.
Frequently Asked Questions
Do Australian businesses have to report a data breach?
If the Privacy Act 1988 covers your business, yes. Under the Notifiable Data Breaches (NDB) scheme, you must notify affected individuals and the Office of the Australian Information Commissioner (OAIC) when a data breach is likely to result in serious harm. If you only suspect a breach, you must assess it promptly and take reasonable steps to complete that assessment within 30 days.
Does the Privacy Act apply to small businesses?
Generally, businesses with an annual turnover of $3 million or less are not covered by the Privacy Act. However, some small businesses are covered regardless of turnover, including health service providers, businesses that trade in personal information, contractors providing services under a Commonwealth contract and credit reporting bodies. Even where the Act doesn’t apply, protecting customer data is still good business practice.
What penalties apply to serious privacy breaches in Australia?
Since 13 December 2022, the maximum civil penalty for a company’s serious interference with privacy has been the greatest of $50 million, three times the benefit obtained from the contravention or, if that benefit can’t be determined, 30% of its adjusted turnover for the relevant period. These higher penalties were introduced in the wake of the Optus and Medibank breaches. The Optus proceedings concern earlier conduct, so the maximum there is $2.22 million per contravention.
What should you do if your personal information is exposed in a data breach?
Act quickly. Secure your online accounts with strong, unique passwords and multi-factor authentication, watch closely for scams and suspicious messages, and replace any stolen identity documents. Keep a record of what was exposed and the steps you take. IDCARE offers free support and advice tailored to your situation if you are worried about identity theft.
Do businesses have to report ransomware payments in Australia?
Many do. Since 30 May 2025, the Cyber Security Act 2024 has required businesses with an annual turnover above $3 million, and certain critical infrastructure entities, to report a ransomware or cyber extortion payment to the Australian Signals Directorate (ASD) within 72 hours of making the payment or becoming aware it was made. ASD’s advice is never to pay a ransom.
Where can an Australian business report a cyber incident?
Report cyber security incidents to ASD’s Australian Cyber Security Centre through the “Submit a Report” page on cyber.gov.au, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) for help. If personal information is involved and serious harm is likely, you may also need to notify the OAIC under the NDB scheme.
