It’s been 12 Months since the Optus Breach. Now What?
Posted: Monday, Sep 25
  • KBI.Media
  • $
  • It’s been 12 Months since the Optus Breach. Now What?
Karissa Breen, crowned a LinkedIn โ€˜Top Voice in Technologyโ€™, is more commonly known as KB. A serial Entrepreneur that Co-Founded the TMFE Group, a holding company and consortium of several businesses all relating to cybersecurity including, an industry-leading media platform, a marketing agency, a content production studio, and the executive headhunting firm, MercSec. KBI.Media is an independent and agnostic global cyber security media company led by KB at the helm of the journalism division. As a Cybersecurity Investigative Journalist, KB hosts her flagship podcast, KBKast, interviewing cybersecurity practitioners around the globe on security and the problems business executives face. It has been downloaded in 65 countries with more than 300K downloads globally, influencing billions in cyber budgets. KB asks hard questions and gets real answers from her guests, providing a unique, uncoloured position on the always evolving landscape of cybersecurity. As a Producer and Host of the streaming show, 2Fa.tv, she sits down with experts to demystify the world of cybersecurity and provide genuine insight to businesses executives on the downstream impacts cybersecurity advancement and events have on our wider world.

i 3 Table of Contents

It’s been 12 Months since the Optus Breach. Now What?

Optus, an Australian telecommunications company, experienced a cyberattack last year on September 22, 2022. One of the most prominent breaches in Australian history. As a result, customers had their personal information stolen and leaked on the dark web. Outrage from customers and businesses was rampant across social media, in the media and of course conversation within our cybersecurity industry. As a result, this major breach has now commenced a class action lawsuit led by an Australian consumer law firm, Slater & Gordon.

In order to investigate this breach, Optus enlisted the services of Deloitte. However, Optus is currently seeking to prevent the disclosure of Deloitte’s report on the cyberattack by invoking legal professional privilege. Consequently, the customers whose data was compromised may be unable to learn the details of how the cyberattack occurred, as Optus intends to maintain the confidentiality of the report.

Last year, we tackled the incident on 2Fa.tv to discuss the recent breach and the impact it had on our cybersecurity industry. I was joined by Sean Duca, Vice President, Regional Chief Security Officer โ€“ APJ at Palo Alto Networks and Wayne Williamson CISO AU/NZ from Equifax.

Take a look at what we discussed:

A year has flown by and I wanted to explore how people were approaching the aftermath and their thoughts towards this breach a year later. I called back Sean and Wayne to drop in their 2-cents.

 

Williamson opened with, “What’s happened, one year on? I’d like to say a lot, but I just don’t know if we as a nation have moved fast enough… especially if another ‘major’ breach occurred.โ€

โ€œThe breach last year was a terrible event that affected the lives of millions of Australians, but there may be a silver lining.โ€ Commented Sean Duca, from Palo Alto Networks.

Optus was just the start of the major breaches occurring in Australia. The string of these breaches illuminated the importance that these nefarious attacks can really happen to anyone.

โ€œThe attack served as a wake-up call for Australia, demonstrating that even large and well-resourced organisations can be vulnerable to cyberattacks; all it takes is for cyber adversaries to get it right in one try.โ€

โ€œThis has brought cyber security to the forefront of the Australian public.โ€ commented Duca.

“These things take time, and there are some great visible remnants from the Australian Government’s investment into cyber – the most noticeable being the appointment of a cyber coordinator.โ€ offered Williamson.

Recovering from any breach takes time and the Equifax Chief Information Security Officer, AU/NZ would know, as his company was previously involved in a major breach back in 2017. Hearing from people like Williamson can engender trust on how to navigate these precarious situations.

So now what happens? Lessons learned after mistakes need to be fueled to drive change. People want to know what really happened in detail after any breach forensic investigation, which in turn provides insights into other companies improving their security posture. Optus has requested the courts to stop the release of the Deloitte cyber attack report.

โ€œOne year on, reflecting on the lessons learned from this breach and taking steps to prevent another is essential. We’ve seen significant progress as businesses prioritise their cyber security posture and the government changes data regulations to protect Australians better,โ€ said Duca.

Both the Office of the Australian Information Commissioner (OAIC) and the Australian Communications and Media Authority (ACMA) are investigating the breach, and their findings will be made public eventually. When eventually is, weโ€™re not quite sure yet.

โ€œHowever, on the privacy side, we haven’t yet seen strong mechanisms applied that would allow greater enablement to individuals on their rights to control how their personal information is collected, used and retained. In saying this, I am positive we will see it – but when?” Williamson commented.

Australia’s National Cyber Security Coordinator is also working on cybersecurity issues.

โ€œWe hope to see greater public-private collaboration as the government drafts its next cyber security strategy to create a framework that builds on established cyber security best practices and state-of-the-art capabilities to strengthen Australia’s cyber resiliency.โ€ Duca said.

What we do know is that post incident trust goes south quickly. Optus has become the least-trusted company in Australia due to this incident, according to Roy Morgan research.

Table of Brand Trust to June 2023 Roy Morgan.

Source: Roy Morgan Single Source (Australia). Risk Monitor, 12 month average to June 2023. Base: Australians 14+, n=25,662. Arrows with numbers show ranking change since March 2023.

This report talks about how people in Australia trust or don’t trust different brands. It found that Optus became the least trusted brand because of a data breach they had in 2022. Even though people’s trust in Optus has improved a bit since then, many still don’t trust them as much as before.

The report says that once people start distrusting a brand, it’s hard for the brand to regain trust. This is a problem for not only Optus but also for the telecommunications industry as a whole because it’s now the least trusted industry in Australia. Other brands like Medibank and TikTok have also lost trust recently. On the other hand, brands like Woolworths and Coles are the most trusted ones. The report suggests that companies should take distrust seriously because it can affect their business.

Source: https://www.roymorgan.com/findings/9306-risk-monitor-quartely-update-june-2023

Share This