Optus will be probed by two Australian regulators over the circumstances that led to the company’s massive data breach that exposed the personal information of millions of customers last month.
The Australian Communications and Media Authority (Acma) and the Office of the Australian Information Commissioner (OAIC) announced separate but coordinated investigations on Tuesday into Optus.
The Acma investigation will focus on whether Optus is meeting its obligations as a telecommunications companies regarding the acquisition, authentication, retention, disposal and protection of personal information, and requirements to provide fraud mitigation protections.
The OAIC investigation will look at whether Optus took reasonable steps to protect its customer’s personal information.
Optus could face fines of up to $2.2m for each privacy contravention if the OAIC decides to take the company to court.
Neither agency has indicated when the investigations will be completed, but Acma said it would take “some time” to complete.
Acma’s chair, Nerida O’Loughlin, said she looked forward to Optus’s full cooperation.
“When customers entrust their personal information to their telecommunications provider, they rightly expect that information will be properly safeguarded. Failure to do this has significant consequences for all involved,” she said.
A spokesperson for Optus said the company was committed to working with the regulators in responding to the impacts of the breach.
It is now nearly three weeks since Optus revealed the personal details of its 10 million customers were exposed in a data breach, which included identity document numbers such as passport, licence and Medicare numbers for hundreds of thousands of Australians.
The regulatory investigations will come in addition to the external review being conducted by Deloitte for Optus. However, the regulatory investigations will be made public.
The Australian federal police is also running two concurrent investigations into who obtained and attempted to sell the data, and protection for the 10,200 customers who had their records posted online last week.
The consumer watchdog has also revealed it is being flooded with Optus-related scam complaints in the wake of the data breach.
The head of the Australian Competition and Consumer Commission said the regulator’s scam team had received about 600 complaints a day related to the breach.
The chair of the Australian Competition and Consumer Commission, Gina Cass-Gottlieb, said many scammers were taking advantage of the large-scale data breach and posing as the telecommunications giant or Equifax Protect, the credit reporting agency tasked with supporting victims of the breach, to swindle consumers.
She told a parliamentary committee that people were confused about the legitimacy of the communications.
So far, Cass-Gottlieb said, there had been only a few instances of fraudsters successfully scamming victims out of money by pretending to be from Optus.
“What we can see is it’s only a small number of people who have become a victim to a scam, but many are alert to it and are most of all confused and anxious,” she said.
It was positive to see more people alert to scam risks, she said.
