Australian Telecommunications Company revealed the extent of a massive data breach that targeted personal information, resulting from an attack by an anonymous user.
The Guardian reports that the telco claims that around 150,000 passport and 50,000 Medicare numbers were stolen after an external review was conducted.
What The People Know So Far About The Attack
The alleged attacker came forward as "Optusdata," a user on a data breach forum who threatened to sell all the data they accumulated from Optus unless they got paid with a million US dollars worth of cryptocurrency.
Reports suggest that the hacker had an application programming interface that did not require authentication to access customer data at Optus, according to The Guardian.
"Without technical controls for authentication and authorisation in place, any user could have requested any other user's information," senior manager of cyber security consulting for Moss Adams Corey J. Ball tells the Guardian.
Josh Lemon, a SANS Institute digital forensics and cyber incident expert, told The Guardian that this type of cybersecurity attack and the breach is a common method of attack.
He added that attackers often opt not to target organizations and usually look through the internet for security vulnerabilities that they can exploit for a huge sum of money.
Optus confirms that the data stolen from their base included names, email addresses, postal addresses, phone details, birthdays, and identification numbers of Australians who trusted the telco's service.
An Investigation Reveals More Information
A few days after the breach, the Singtel-owned Australian operator had invited Deloitte to conduct an independent investigation on the breach, ZDNet writes.
From the investigation, it was found and confirmed that over two million customers had government information compromised, and about ten million customers had their mobile carrier data exposed, says Bleeping Computer.
Optus CEO Kelly Bayer, ZDNet reports, said the review would shed light on how the attack occurred and how it can be prevented.
These types of attacks happen commonly in the private and public sectors where sensitive data is stored and at risk of cyberattack.
According to ZDNet, the breach had compromised at least one number from users' list of current and valid personal identification information that may still be used if customers do not take action to change their details.
The Guardian says that Optus had sent text messages and emails to customers already who had their information taken, promising that they are working to provide advice to customers on the matter.
What Happens Next After The Optus Breach
The review conducted by Deloitte urged technical professionals and the federal government to work with telecommunication providers to ensure data safety, The Guardian reports.
"Clearly we need better national laws after a decade of inaction to manage the immense amount of data collected by companies about Australians, and clear consequences for when they do not manage it well," Australian Prime Minister Anthony Albanese told ZDNet.
The Guardian confirms that the federal government is already working with international enforcement authorities to locate where the hacking took place and who was really behind it.
The Australian government is now also looking to urgently reform its cybersecurity policies to protect customers from possibly being compromised in another data breach.
Related Article: Samsung Confirms Another Data Breach - Was Any Customer Data Stolen?
