Optus says it still does not know how much customer information was stolen nearly a year after a massive cybersecurity breach, and has denied it had a duty of care to protect the affected customers from harm.

In its defence to a class action lodged by Slater & Gordon in early April, the company argues that it should not be forced to pay compensation even if it breached telecommunications laws requiring users’ personal data to be stored securely, as the wait for an external review into the breach drags on.