Breach case · Asia Pacific · September 2022

Optus Customer Data Breach

One of Australia's largest telecom providers disclosed a breach affecting millions of current and former customers.

Incident

What happened

Optus announced that customer personal information, including identity document numbers for some customers, had been accessed.

Public reporting attributed the access to an exposed application programming interface (API).

The incident prompted Australian regulatory investigations and changes to privacy law penalties.

Analysis

APIs must enforce authentication and authorisation on every endpoint.

Test and legacy endpoints should be inventoried and decommissioned.

Data minimisation limits the impact when a breach occurs.

Prevention

API penetration testing verifies authentication, authorisation for individual objects, and exposure of undocumented endpoints.

Summary based on publicly available information. DIGITPOL HK was not involved in this incident.