An Overview of the Optus Infotech Hack

Australian telecom giant, Optus, fell victim to a hack. Exposing nearly 2.1 million of its current and previous clients suffered a data leak of their personal and critical information. With at least one form of their identification number leaked due to the breach. Optus infotech has already started its quest to try and save itself. Enlisting the help of Deloitte to conduct a forensic assessment of the attack to dissect further how it occurred and how they can prevent it again. Singapore extended the hand of help, primarily since the Singaporean SingTel parent company owns Optus.

How Did it Happen

A criminal investigation by the Australian Federal Police is currently taking place. Trying to get to the origins of the Optus cyberattack and the methods used by the hacker. The hack is sophisticated, utilizing multiple European IP addresses that kept transforming during the hack. The culprits are rumored to be state-sponsored hackers. Earlier in October, a Sydney resident was arrested for allegedly trying to use the stolen Optus infotech data in an SMS extortion scam. It is noted that he is not the main suspect in the investigation nor the main suspect in the initial data breach.

In contrast, Home Affairs minister “Claire O’Neil” labeled the attack as fundamental and pointed the finger at Optus infotech for leaving its system under-protected. With an unprotected Application Programming Interface (API), a computer communication system allows software systems to communicate with others. Optus CEO Kelly Bayer Rosmarin stated that the data was encrypted and protected by multiple layers of defenses.

Who Fell Victim

Optus infotech stated that up to 9.8 million Australians could have their data affected by the hack, and around 2.8 million could be critically affected. Additionally, Optus pointed out that 17 000 Medicare numbers are in the breached records, with over 26 000 expired Medicare numbers also to be exposed. Essential data, such as passport numbers of around 10 thousand users, were also disclosed. 

Optus asserts that it has now contacted the consumers most affected by their role in the assault. However, other less affected customers may not have received a notification whose information was leaked in emails and names. Customers concerned about their data can safely and immediately contact the telco through the My Optus app.

Even former Optus customers should pay attention because Optus management warned that the attack would affect customers as soon as 2017. Anecdotally, some Optus customers left the company prior to 2012 assert that they are involved, albeit these assertions have not been corroborated.

Customers on the majority of Optus MVNOs, including amaysim, Coles Mobile, and Catch Mobile, have not been harmed. On the other side, GOMO subscribers might have been impacted. Optus will get in touch with impacted GOMO users within the next few days.

The Hacker Demands

The hackers threatened Optus infotech, via an online forum, that they would publish the critical data of ten thousand Optus customers daily unless they received untraceable one million dollars’ worth of cryptocurrency. They then proceeded to post the data of 10,200 clients.

On another note, victims of the hack started receiving text messages. The messages notified them that they needed to pay 1 300 dollars in two days. Otherwise, the hacker would sell their data for fraudulent purposes. It is not sure that the source of these messages is the same hacker who demanded the crypto money. The texts did come labeled with the name OptusData. It might be someone who found a way to access the dataset after the original hacker shared it on the forum.

What Now

The Australian residents who fell victim to the Optus breach will have easy access to change their driver’s license numbers and receive new cards. Governments of New South Wales, Victoria, South Australia, and Queensland have cleared the bureaucratic obstacles and hurdles for any individual who can provide proof that they fell victim to the hack. Optus infotech will have to bear the weight of the millions of dollars in compensation as they pay for these new driver’s licenses.

A class action lawsuit is looming on the horizon for Optus. In comparison, Optus offers a 12-month subscription credit monitoring and protection services. The Commonwealth Bank has tracked down and identified the account of the SMS culprit. Optus will proceed to contact all the clients with unexpired Medicare cards. The Australian telco will contact the holders directly, assuring them that the hack cannot be as harmful as they think. Hackers cannot access critical information using only a Medicare number and data.

Finally, the unsettling element is uncertainty. The culprit issued an apology, one of them at least. But can we trust criminals when they just say they deleted the data? Someone who just committed a crime, even if he’s sorry for it, it does not have a valid reason to take their word for it. And even if we did, no one can be so sure that the person sharing these statements is the actual person possessing all the data. You must remain diligent. Many phishing hackers will try to take advantage of these times and hack you while offering help.

Concluding Thoughts

No one is safe. If hackers can attack a giant like Optus, the smaller fish out there are not safe either. The victims now live with the constant threat of their data being sold or used for swindles and fraudulent activities. Some say that the breach was preventable, and others deny it. What matters is that everyone must upgrade their security and. In turn, educate themselves on the threats looming around their data.

Inside Telecom provides you with an extensive list of content covering all aspects of the Tech industry. Keep an eye on our Cybersecurity section to stay informed and updated with our daily articles.