Optus customers who signed up using international identification say they feel abandoned by the company, and are unsure whether they need to replace documents or who will cover the cost.
Jack*, a United States citizen living in Melbourne, received an email from Optus in late September informing him his passport ID number had been exposed in the high-profile data breach, along with his date of birth and other personal details.
Jack said he had not received any communication from Optus since then, and had struggled to get more information from his local store, via online chat, or even by calling the company.
"You just feel completely ignored and you're getting no help from Optus at all," he said.
For newcomers to Australia, signing up for a new phone number is often one of the first things they do — and handing over a passport as ID can be an unavoidable part of that process.
In response to repeated questions from the ABC about its replacement policy for international ID documents, an Optus spokesperson said it was "engaging constructively with the relevant overseas agencies to determine the impact on and what actions, if any, should be taken by customers".
According to the telecommunications company, approximately 1.2 million customers had at least one number compromised from a current and valid form of identification, as well as personal information.
The company declined to say how many of these customers were foreign passport holders.
Who gets new passports?
In some states, the cost of replacing drivers licences has been waived for affected customers who need new ID, while the company will reimburse others.
Optus will also cover the cost of replacement passports for affected customers, according to the Australian Passport Office, but the company would not clarify to the ABC whether this policy applied to overseas document holders.
Jack said when he saw Prime Minister Anthony Albanese on the news demanding Optus pay for passports that needed to be changed following the breach, he guessed that didn't mean foreign passport holders.
"Immediately my mind went to: they are only talking about Australian passports," he said.
"Every day is another day that someone can completely take my identity.
"Someone could be borrowing money in my name, renting a car in my name."
A spokesperson for the US embassy said passport guidance for US citizens remained unchanged, and it did not recommend reporting the document if the passport number was compromised.
"You should only report your US passport lost or stolen if the original, physical version of the passport book or passport card has been lost or stolen," she said.
"The US passport book and passport card are highly secure documents with numerous security features designed to prevent successful counterfeiting."
The ABC has been contacted by past and current Optus customers who signed up using foreign documents.
For those with temporary visas attached to their current overseas passport, the situation is particularly unclear.
"Nobody talks about foreigners," said Natasha*, a Russian student in Melbourne.
"People who have student visas, people who rely on foreign passports … I would imagine that's a lot of people."
Natasha was also told by Optus her ID details were exposed even though she ceased being a customer earlier this year.
She said she would likely have to travel to Sydney to have her Russian passport replaced at the consulate, and wanted Optus to reimburse the cost.
"Then there's the question of who will pay for tickets and accommodation, because it will take a few days," she said.
"I don't have thousands of dollars to go to Sydney."
Alex* is in a similar situation. A German citizen living in Darwin, she signed up with Optus around eight years ago with a German passport that has now expired.
She has been trying to find out if the company exposed her new German passport number that she may have used when changing plans, but without success.
As well as getting all the necessary documents, she estimated replacing her German passport would cost up to $300 and take potentially half a day. Asked said she "100 per cent" wanted Optus to cover the cost.
A spokesperson for the German embassy in Australia said applications for new passports should typically be made when the document is valid for six months or less, but said it was "allowing exceptions for those affected by recent data breach".
"Passport fees are to be borne by respective applicants," he said.
'Unthinkable back in Europe'
The Optus data breach has prompted renewed conversations about the adequacy of Australian privacy law, and the government has flagged the need for greater penalties for companies that do not adequately protect customer information.
For those from the European Union, where privacy laws are typically much stricter, the contrast feels stark.
Alex is waiting for Optus to announce it has deleted all the information it held about customers unnecessarily, in her view; especially identity documents.
I've been living here for eight years now, so I'm starting to get used to the lack of protection of privacy in Australia," she said.
"These are things that would be completely unthinkable back in Europe."
Home Affairs, the Department of Foreign Affairs and Trade, and the Russian embassy were contacted for comment.
*Names have been changed to protect the privacy of those affected by the data breach.
