INCIDENT REPORT · CP-2022-003

Optus customer data breach

L3 · ELEVATEDCONFIRMED

Australian telecommunications provider Optus disclosed in September 2022 that a cyberattack had exposed personal data of current and former customers.

Incident ID: CP-2022-003
Disclosure date: 22 SEP 2022
Detection date: Not publicly documented
Affected countries: Australia
Plotted location: Sydney, Australia (Affected organization headquarters)
Threat classification: Level 3 — ELEVATED
Classification rationale: Breach affecting roughly a third of Australia's population at a major telecom provider.
Attack type: Data Breach
Nature: Malicious activity
Attack vector: Publicly accessible API exposing customer data, which ACMA alleges resulted from a coding error left undetected for years
Sectors: Telecommunications
Critical infrastructure: Yes
Organizations affected: Optus (Singtel Optus)
Operational consequences: The OAIC says the privacy of about 9.5 million Australians was affected. Optus initially gave a worst-case figure of up to 9.8 million. Both ACMA and the OAIC have taken Federal Court action against Optus.
Estimated financial impact: No reliably documented figure
Attribution (as stated): No official attribution recorded

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Optus customer data breach

L3 · ELEVATEDCONFIRMED

Australian telecommunications provider Optus disclosed in September 2022 that a cyberattack had exposed personal data of current and former customers.

Incident ID

CP-2022-003

Disclosure date

22 SEP 2022

Detection date

Not publicly documented

Affected countries

Australia

Plotted location

Sydney, Australia (Affected organization headquarters)

Threat classification

Level 3 — ELEVATED

Classification rationale

Breach affecting roughly a third of Australia's population at a major telecom provider.

Attack type

Data Breach

Nature

Malicious activity

Attack vector

Publicly accessible API exposing customer data, which ACMA alleges resulted from a coding error left undetected for years

Sectors

Telecommunications

Critical infrastructure

Yes

Organizations affected

Optus (Singtel Optus)

Operational consequences

The OAIC says the privacy of about 9.5 million Australians was affected. Optus initially gave a worst-case figure of up to 9.8 million. Both ACMA and the OAIC have taken Federal Court action against Optus.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

No official attribution recorded