Communications watchdog suing Optus over data breach

Australia’s second largest telecommunications company, Optus, says it will defend Federal Court action brought by the communications watchdog over a September 2022 data breach in which about 10 million current and former customers had their personal data stolen in one of the worst cyberattacks in the nation’s history.

The Australian Communications and Media Authority (ACMA) alleges Optus breached the law when it failed to protect its customers’ personally identifiable information – including driver’s licences, passport numbers, home addresses and dates of birth – from hackers.

Former Optus chief executive Kelly Bayer Rosmarin during a Senate hearing last year. She resigned three days later.Credit: Alex Ellinghausen

About 40 per cent of the population are Optus customers and many couldn’t use their phone or internet services on the day of the breach, when hackers demanded a $1.5 million ransom to stop the data from being sold online. A few hours later the thieves deleted the ransom notice and apologised.

The Optus breach led to tougher penalties for serious or repeated breaches of customer data; organisations that fail to adequately protect people’s data now face fines of $50 million or more.

Optus’ then-chief executive Kelly Bayer Rosmarin resigned in November 2023 after presiding over the data breach and then a subsequent mass outage just over a year later. Current NBN Co chief executive Stephen Rue is set to take the top job at Optus in November.

“At this stage, Optus Mobile is not able to determine the quantum of penalties, if any, that could arise,” Optus’ parent company Singtel said in a statement to investors.

“Optus has previously apologised to its customers and has taken significant steps, including working with the police and other authorities, to protect them. Optus Mobile intends to defend these proceedings.

“As the matter is now before the Australian courts, Optus Mobile will not be commenting further at this time.”

ACMA declined to comment.

Optus is currently also embroiled in an ongoing legal fight to prevent a report into the data breach from being released publicly, as part of a class action lawsuit from Slater and Gordon.

Ranish Kromodoyo and Anya Absalom struggle to make a call outside an Optus store.Credit: Chris Hopkins

The telco posted its half-year financial results on Thursday, with operating revenue down 1.1 per cent year-on-year amid lower revenues for its enterprise unit, though mobile service revenues climbed higher. The company added 116,000 mobile customers for the full-year ending March 31, 2024, primarily from its low-cost Amaysim brand.

Operating revenue was flat over the 12 months to March 31 at $8 billion, with operating expenses also flat at $6 billion.

“Optus is working hard to rebuild the trust of customers after a challenging 18 months and these results demonstrate we are on the right track,” Optus interim chief executive Michael Venter said.

“We’re listening to our customers and in the year ahead we’ll be continuing to prioritise what we know is important to them – a resilient network that delivers seamless connectivity, great value products and services, and simple, efficient customer service.”

Parent company Singtel has also flagged a strategy refresh for Optus’ enterprise unit, which has faced pressures from macroeconomic headwinds, increased competition and structural declines as large business customers increasingly move away from fixed voice products and switch to cheaper cloud-based options from the likes of Microsoft.

It said it will streamline its product catalogue from more than 250 to fewer than 100 products, slash its vendor portfolio from more than 100 to 16 partners, and “exit unprofitable businesses”. Optus employs about 7500 people nationally.

“Essentially what’s happening is that the way customers are using enterprise products has shifted,” Venter said. “I don’t know about you, but I don’t have a fixed-line phone on my desk, and I haven’t for a long time. That was a high-margin business and it’s just a structural shift that’s occurred that means those margins are no longer what they were.”

Telstra this week cited its underperforming enterprise unit as a key driver behind a decision to cut up to 2800 jobs, with 9 per cent of its workforce to depart the company this calendar year.

Venter added that Optus had reduced its overall head count by about 10 per cent over the past year amid the falling enterprise revenue, alongside damage from the data breach and subsequent outage.

“It’s been a difficult 18 months for Optus but the business is bouncing back and we’re seeing green shoots. We understand that regaining customer trust takes time, it will be brick by brick and step by step.”

Get the day’s breaking news, entertainment ideas and a long read to enjoy. Sign up to receive our Evening Edition newsletter.