Optus has been hit by a cyber attack that has compromised customer information, the telecommunications company says in a statement.
Information that may have been exposed includes customers' names, dates of birth, phone numbers and email addresses, Optus says.
For some customers, addresses and ID document numbers such as driver's licence or passport numbers have been exposed.
The breach involves both current and former customers, Optus CEO Kelly Bayer Rosmarin told the ABC.
"It's just too early for us to give specific numbers. It is a significant number and we want to be absolutely sure when we come out and say how many [customers have been affected]."
The company says it has shut down the attack, notified the Australian Federal Police, and is working with the Australian Cyber Security Centre on the issue.
"We are devastated to discover that we have been subject to a cyber attack that has resulted in the disclosure of our customers' personal information to someone who shouldn't see it," Ms Bayer Rosmarin said in a statement.
Optus says it does not know if anyone has suffered any harm as a result of the breach, but they have encouraged customers to have "heightened awareness" accounts.
"Including looking out for unusual or fraudulent activity and any notifications which seem odd or suspicious," Ms Bayer Rosmarin said.
Payment details and account passwords have not been compromised, Optus said.
Minister for Cyber Security Clare O'Neil said the Australian Cyber Security Centre was aware of the breach and was providing advice and technical assistance.
The Australian cyber security organisations have seen broad targeting of Australians and Australian organisations by state actors and cybercriminals seeking to steal sensitive data.
Optus said it has notified the Australian Federal Police, the Office of the Australian Information Commissioner and other regulators.
"I can't go into the details of the work, but we have a very committed cyber team who is doing everything they can to identify the scope and scale of what information has been accessed," Ms Bayer Rosmarin told the ABC.
Affected account holders should be notified soon, Ms Bayer Rosmarin said, adding that customers could take specific actions to ensure their own cyber security.
"Passwords weren't compromised. So the main action for everybody is to just have an increased vigilance, so that we can spot if this data is being used early and prevent it being used for more customers," she said.
