Slater and Gordon class action includes more than 100,000 past and present Optus customers

Victims of domestic violence and stalking as well as a retired police officer are among those seeking compensation, alleging the telco failed to protect vital data.

More than 100,000 former and existing Optus customers are part of a class action launched by legal firm Slater and Gordon accusing the telco of breaching privacy, telecommunication and consumer laws and internal policies following a massive data hack.

Optus on September 22 revealed the personal information of up to 10 million of its current and former customers had been compromised in a cyber attack.

Data including customer names, dates of birth, phone numbers and email addresses were accessed by, and/or disclosed to, an unknown number of unauthorised persons. Some customers’ addresses, ID document numbers such as driver’s licences, Medicare cards and passport numbers had also been compromised.

The personal information of more than 10,000 customers was subsequently published online when ransom demands were made.

The class action claims Optus allegedly failed to protect or take reasonable steps to protect customer data from unauthorised access or disclosure, failed to destroy or de-identify former customers’ personal information, and failed to ensure legitimate access to the data.

“Optus has also been accused in the class action of breaching contractual obligations to customers along with its duty of care to ensure customers did not suffer harm arising from the unauthorised access or disclosure of their personal information,” Slater and Gordon said in its statement.

Among those seeking redressal is an unidentified domestic violence victim, who has spent her counselling funds pool on increasing security measures around the house, including installing video cameras and extra locks on doors and windows.

A stalking victim is fearful after “her life has genuinely been put in danger by the data breach,” the law firm said.

Optus chief executive Kelly Bayer Rosmarin at a press conference on data hack in September.

The exhaustive list also includes a retired police offer who is concerned criminals have got access to his home address, while a former Optus customer who previously had his identity stolen is now suffering “severe anxiety” over the repeat experience.

“I had to make a lot of calls and do a lot of running around in the aftermath of this breach to make sure my bank account and other accounts hadn’t been compromised, and I noticed I was being targeted by phishing and other scams a lot more frequently,” one victim told Slater and Gordon.

Another said: “it was incredibly stressful trying to get answers from Optus about what information had been exposed and then taking action to rectify the damage so I could try to stop anything else from happening.”

Compensation is being sought for losses the data breach caused, including time and money spent replacing identity documents in addition to other measures to protect their privacy and prevent the increased likelihood of them falling victim to scams and identity theft. Damages for non-economic losses such as distress, frustration and disappointment are also being sought.

Slater and Gordon’s Ben Hardwick said it was “an extremely serious privacy breach both in terms of the number of people affected and the nature of the information that was compromised”.

“Very real risks were created by the disclosure of this private information that Optus customers had every right to believe was securely protected by their telecommunications and internet provider,” Mr Hardwick said.