By now, you’ve likely seen the news about Optus, Australia’s second-largest telco, having suffered a serious data breach, and the exposing of the private information of their millions of current and historic users through a malicious cyber-attack.
What might not be clear to many, is the implications of the breach, and steps that can be taken toward remedy. I write this article in the hope of explaining why people need to care about this breach, especially if they’re an Optus customer.
Succinctly, Jason Baden, Regional Vice President, ANZ for multi-cloud security and application delivery company, F5, stated “The personal data of many Australian citizens will be in the hands of criminal or state actors”.
The specific details of the attack are still trickling out through Optus’ media consultants, and the exact nature of precisely what data was exfiltrated has still not been released in full fidelity. This naturally leads to countless speculations from genuine experts, and the criticisms from the armchair quarterbacks of the less scrupulous vendors, culminating in a cloud of half-truths and suppositions, peppered with validated – or at least likely – kernels of truth.
In the spirit of this evolving situation, we will be updating our comments as we find out more about the attack, and ultimately doing a full biopsy of the attack.
The Implications
One thing I believe that’s important to remember – as a business or a consumer – is the possible nefarious uses of the stolen data by the threat actors. Baden went on to stipulate, “That data could be used to sign up for new mobile services, open mule bank accounts, gambling accounts, or pursue social engineering for purposes of fraud and money laundering.”
As we still don’t know the nuances of the breached data, the seeming scale of what was stolen means that the repercussions will very likely be both significant and sustained. Moreover, the impacts of this incident may not manifest immediately, making detection and quick remediation more challenging. Baden went on to say, “The impact of breaches like this is much wider than the initial organisation hit – now everyone needs to be on notice, both individuals and organisations such as banks, gambling companies, telcos, loyalty programs, and more.”
So, How Do I Know If I’m At Risk?
According to Optus, they will get in touch with any of their business or consumer clients they believe are likely to have had their information taken, by sending out customised notifications.
Customers who suspect their data may have been compromised, or who have specific concerns, are urged to get in touch with Optus by phoning 133 937 or using the My Optus App, which the company claimed to be the safest method of communication.
According to Optus, links in emails or SMS messages will not be sent.
What Can I Do Right Now To Feel Protected?
Customers of Optus are advised by Scamwatch to secure their personal information by changing the passwords for their online accounts and turning on Multi-Factor Authentication (MFA) for banking.
- Call your bank and let them know you’ve been impacted by the breach
- Monitor for any suspicious behaviour on any of your accounts
- Use a monitoring platform like Credit Savvy to monitor for you
- Raise a request through your State Government for a new licence or a full change of Licence No.
If your driver’s licence has been compromised due to the breach, please see below steps to follow to create a new licence number:
ACT: https://www.accesscanberra.act.gov.au/s/article/act-driver-licence-information-tab-overview
QLD: https://www.qld.gov.au/transport/licensing/driver-licensing/renew-replace/replace/person
WA: https://www.transport.wa.gov.au/licensing/replace-my-licence.asp
TAS: https://www.transport.tas.gov.au/licensing/renew_replace_or_update_licence/replacing_your_licence
If you don’t already have one, obtain a CIRS online through Report Cyber. This takes around 5 minutes https://www.cyber.gov.au/acsc/report
It’s important to note that for identity verification checks, card number is now required for NSW, ACT, SA, TAS, NT and WA issued licences. Unlike the licence number, the card number changes with each new licence issued. This helps to make sure that the document being presented is the most recently issued document and helps to minimise the risk of identity theft using a stolen or lost driver licence.
UPDATE:
Sep 27th 2022, 11:27AM
Comments from Victor Dominello MP
Minister for Customer Service and Digital Government, Minister for Small Business, Minister for Fair Trading at NSW Government
“I can confirm Optus will contact customers in coming days to confirm whether or not they need to apply for a replacement driver licence.
People in NSW with a digital driver licence will have an interim card number issued instantaneously via the Service NSW app. A new plastic licence card will be issued within 10 business days. Information can be found here: https://lnkd.in/gDAiEJx6
The cost to replace your driver licence is $29 and will be charged by Service NSW at the time of application – reimbursement advice will be issued by Optus to customers in the coming days.
NSW customers who need support regarding the replacement of identity documents and advice on preventative actions they can take, are encouraged to contact ID Support NSW on 1800 001 040.
The NSW Government will provide further advice to impacted customers as more information comes to light.”
Further details on this breach will be added as more information comes to light.
