MyRecon OSINT

← Case Files · The Breach Files

2022 · Telecommunications

Optus, 2022: an API with no lock on it, and 9.8 million Australians

Case file · 4 min read · Published 14 September 2026

People affected
9.8 million customers; about 2.1 million with identity document numbers
When it happened
September 2022
Made public
22 September 2022
How they got in
An internet-facing API endpoint that required no authentication and allowed enumeration of customer records
Attributed to
An extortionist who posted samples, demanded US$1 million, then withdrew the demand
What it cost
Regulatory proceedings by two Australian regulators, a class action, and the cost of reissuing identity documents nationwide

What was exposed: Names · Dates of birth · Phone numbers · Email addresses · Addresses · Passport numbers · Driver's licence numbers · Medicare numbers

Most breaches require someone to break something. The Optus breach required someone to find an address. An internet-facing API served customer records to anyone who asked, with no authentication and no meaningful rate limiting, and the records were addressed by identifiers that could simply be counted upwards.

What happened

On 22 September 2022, Optus — Australia's second-largest telecommunications company — disclosed that customer data had been taken. The eventual figure was 9.8 million current and former customers, in a country of roughly 26 million people. Around 2.1 million of those records contained at least one government identity document number: a passport, a driver's licence, or a Medicare number.

The mechanism, as set out in the regulatory proceedings that followed, was an API endpoint exposed to the public internet without any requirement to authenticate. Requests for customer records were accepted from anyone, and the identifiers used to address those records were sequential enough to enumerate. There was no exploit, no malware, and no stolen credential. Somebody found the endpoint and iterated.

The specific engineering failure. Two controls were missing at once. Authentication, so that only an authorised caller gets an answer. And authorisation on the object itself, so that even an authenticated caller can only fetch records they are entitled to — the flaw category known as insecure direct object reference. Either one alone would have limited this to a nuisance. Together, their absence turned a customer lookup into a public database export.

The extortion that fizzled

Days after the breach, an account using the name "optusdata" posted a sample of 10,000 records and demanded US$1 million in cryptocurrency, threatening to release more daily. Then, abruptly, the demand was withdrawn with an apology and a claim that the only copy had been deleted.

Whatever happened behind that reversal — the scale of the attention from Australian federal police is the usual assumption — the episode illustrates something important. A deletion claim is unverifiable. Once records have been copied, the only honest position for the affected company is that the data is gone and will not come back, which is what Optus and the government proceeded on.

Why identity documents made this a national problem

A leaked email address is a nuisance. A leaked passport number is an administrative emergency, because Australian identity verification — opening a bank account, taking out credit, getting a phone contract — runs on a small set of document numbers. Once those are in circulation, the verification system itself is degraded for the people affected.

The response had to be structural:

  1. Mass reissue. State governments replaced driver's licences, in several cases at Optus's expense. Passport replacement became a public argument about who pays.
  2. Emergency data sharing. Temporary regulations let telcos pass limited identity data to banks and government agencies, so that compromised document numbers could be flagged for extra scrutiny rather than silently trusted.
  3. A licence-number change. Several states moved to card numbers that can be reissued independently of the licence itself, so a future leak does not require replacing the whole document.

The timeline

  1. September 2022 — The exposed endpoint is found and customer records are extracted.
  2. 22 September 2022 — Optus discloses the breach.
  3. 24–27 September — An extortionist publishes 10,000 records, demands US$1 million, then withdraws the demand.
  4. Late September — State and federal governments begin coordinating document reissue; emergency data-sharing regulations are made.
  5. December 2022 — The Privacy Act penalty regime is sharply increased.
  6. 2023 — The communications regulator begins federal court proceedings.
  7. 2024 — The privacy regulator commences civil penalty proceedings; class action litigation continues.

What it changed

Australia's privacy penalties stopped being symbolic. The pre-2022 maximum — around A$2.2 million — was a rounding error for a telco. The new ceiling, tied to turnover, moved privacy into the same enforcement bracket as competition law.

Data minimisation became the headline lesson. The most-asked question in the aftermath was not how the endpoint was exposed, but why a telecommunications company still held passport numbers for former customers years after verifying them. Retaining identity documents after the verification is complete converts a one-off check into a permanent liability, and regulators across several countries have used Optus to make that argument since.

API security became a board-level term. Traditional security programmes were built around networks, endpoints and web applications. This breach was none of those: a documented, intentional interface with a missing control. API inventories and authorisation testing moved up every roadmap in the region.

If you were an Optus customer

  1. Replace any exposed document you have not already replaced. A licence or passport number in circulation does not expire on its own.
  2. Place a credit ban or credit report freeze with the Australian credit bureaus. It is the specific control against someone opening credit with your documents.
  3. Set a port-out protection on your mobile service. A number plus a full identity file is what makes SIM-swap fraud straightforward.
  4. Distrust contact that quotes your details back to you. Post-breach scam waves in Australia specifically used the leaked fields to sound legitimate — what still gives those messages away.

Checked against every breach on record, against public breach data only. Your address is not sent to us as a form and is not stored — it is handed straight to the lookup tool in your own browser. See the privacy policy.

Questions people ask

How did the Optus breach happen?

Through an API endpoint that was reachable from the public internet and required no authentication. Customer records were addressed by identifiers that could be incremented, so anyone who found the endpoint could iterate through the database. There was no intrusion in the conventional sense — the door was open and the records were numbered.

Why were identity documents the worst part?

Because a passport, driver's licence or Medicare number is what Australian banks and services use to verify identity. A stolen one supports account opening in the victim's name, and replacing them costs money and time. The scale forced state and federal governments into a mass reissue and a rethink of whether telcos should be holding those numbers at all.

Did Optus pay a ransom?

No. An extortionist posted 10,000 records publicly and demanded US$1 million, then withdrew the demand and issued an apology days later, claiming the data had been deleted. There is no way to verify a deletion claim, which is exactly why paying is a poor bet even when the demand is withdrawn.

What changed in Australian law afterwards?

Penalties under the Privacy Act were raised sharply in December 2022 — to the greater of A$50 million, three times the benefit obtained, or 30% of adjusted domestic turnover. Temporary rules also allowed telcos to share identity data with financial institutions and government agencies so compromised documents could be flagged rather than silently reused.

Sources

Read next

Case files are written from the public record: regulatory findings, court filings, company disclosures and contemporaneous reporting, cited above. Figures are the ones the organisation or its regulator finally settled on, which is often not the number first reported — where that differs, the page says so. Disputed accounts are marked as disputed rather than resolved in either direction.

← All case files Breach archive →