Optus customers dating back to 2017 are advised they could be at risk of identity theft after the malicious data breach.
Optus chief executive Kelly Bayer Rosmarin described the breach as the result of "sophisticated criminals". While the motive behind the cyber-attack is not yet known, she said "heightened vigilance" was needed.
So what should you do if you suspect you're at risk?
What should Optus customers do now?
Optus is still encouraging customers to be "extra vigilant".
The telco company says this means:
- Look out for any suspicious or unexpected activity across your online accounts and report any fraudulent activity immediately to your provider
- Look out for suspicious emails, texts, phone calls or messages on social media
- Never click on any links that look suspicious or provide passwords, personal or financial information
Scamwatch has advised Optus customers to secure their personal information by changing online account passwords and enabling multi-factor authentication for banking.
Australian Consumer and Competition Commission (ACCC) said any Optus customers who suspect they are victims of fraud should request a ban on their credit records and be highly sceptical of unexpected calls from people claiming to represent banks or government agencies.
Who is at risk from the Optus data breach?
We don't yet know for sure.
What we do know is that this was a sophisticated attack.
"Without saying too much, the IP address kept moving and came out of various countries in Europe," Ms Bayer Rosmarin said on Friday morning.
In terms of customer data, Ms Bayer Rosmarin says this impacts Optus customers dating back to 2017.
Customers' names, dates of birth, phone numbers, email addresses, driver's licence numbers, passport numbers or addresses could have been accessed in the attack, Optus confirmed on Thursday.
Customers' payment details and account passwords have not been compromised.
Will Optus be contacting those at risk?
Yes.
Optus said it will be contacting customers affected by the data breach in the "next few days".
Ms Bayer Rosmarin said Optus customers that had the most fields exposed would be contacted first.
And all customers will know in the coming days what category they fall into.
If you believe your account has been compromised, you can contact Optus through its My Optus App – which it says remains the safest way to contact Optus, or by calling 133 937.
What can you do if you think your passport number, licence or ID has been used?
The office of the Australian Information Commissioner (OIAC) warns that only a small amount of information is needed to compromise a person's identity.
When it comes to government-issued ID, such as your driver's licence, Medicare card or passport, contact the agency that issued the identity document for advice.
For anyone that believes they are victim to a cybercrime, the Australian Federal Police (AFP) says to immediately contact RportCyber.
You can also:
- Report it to your local police department and give the police report number to your bank
- Contact your bank
- Change your passwords
- Report it to the relevant websites
- Report it to the ACCC's scamwatch
- Contact IDCARE, a free service that will work with you to develop a plan to limit the damage of identity theft
What is Optus doing about the security breach now?
The AFP is working with Optus to obtain information and evidence needed to conduct the criminal investigation.
Optus is working with the Australian Cyber Security Centre to limit the risk to both current and former customers.
Optus said it took action to block the attack as soon as it learned of the breach and that "not everyone may be affected".
The Office of the Australian Information Regulator and other key regulators have also been notified.
ABC/Reuters/AP
