AFP launches ‘Operation Guardian’ to hunt down Optus hacker

The Australian Federal Police says it has a ‘long and complex’ investigation ahead of it, while the telco agrees to pay for thousands of new passports.

AFP Assistant Commissioner Cyber Command Justine Gough speaking on Operation Guardian, delivering specialised protection for Optus customers. Picture: Facebook

The Australian Federal Police has announced the launch of Operation Guardian and an investigation into who is responsible for the Optus data breach, amid news the telco will foot the bill for replacing thousands of customer passports.

Optus has agreed to pay the costs of replacing customer’s passports that were compromised in the telco’s data breach, Prime Minister Anthony Albanese announced on Friday, following demands from the federal government.

“Optus has responded to my request that I made both in the Parliament and Senator [Penny] Wong made in writing to Optus, [and] they will cover the costs of replacing affected customers’ passports. I think that’s entirely appropriate,” the Prime Minister told reporters on Friday. Replacement passports cost $193.

Mr Albanese also attacked opposition government services spokesman Paul Fletcher for calling “upon taxpayers to foot the bill”.

“Paul Fletcher’s comments this morning that attempted to play politics with this issue,” he said.

Foreign Minister Penny Wong had previously written to Optus chief executive Kelly Bayer Rosmarin on Wednesday saying there was “no justification” for Optus customers or taxpayers to pay for replacement passports.

“I therefore seek your earliest confirmation that Optus will cover passport application fees of any customers affected by this breach whose passport information was disclosed and who choose to replace their currently valid passports,” she told Ms Bayer Rosmarin.

The announcement was made hours after Asistant Commissioner Justine Gough said the AFP has commenced “a long and complex” investigation to “supercharge” the protection of more than 10,000 customers whose notification credentials have been unlawfully released online following the telco breach.

She said the alleged hacker, who made away with the data of some 10 million Australians, is yet to be identified.

Commissioner Gough said customers affected by the breach will receive ‘multi-jurisdictional and multi-layered’ protection from identity crime and financial fraud.

“The 10,000 individuals who potentially had 100 points over the notification released online will be prioritised,” she said.

The AFP said it would not be contacting the 10,000 affected individuals who had their data released earlier in the week. The AFP Cybercrime Command will co-ordinate the operation in a joint operation between law enforcement, the private sector and industry.

The commissioner said Optus was “co-operating fully” with the AFP investigation and that Optus had engaged early with the agency, amid concerns that the telco has been too slow to contact affected customers.

Amid reports of scammers contacting Optus customers, members of the public are being urged to look for any suspicious activity across online and bank accounts.

David Lacey, the founder and manager of non-profit IDCARE, said his charity has responded to more than 10,000 requests for information and is providing support to individuals who believed they may be experiencing identity misuse as a result of the Optus breach.

“If you believe you have experienced identity misuse, you can book a time in with an IDCARE Case Manager via their Get Help for Individuals online form at IDCARE.org,” he said.

Kelly Bayer Rosmarin Optus CEO at press conference on data hack September 23

The ‘hacker’, known as Optusdata, has claimed to have deleted the stolen data, after earlier demanding a $1.5m cyber ransom from Optus and releasing the details of about 10,000 customers.

As The Australian previously reported the hacking community is using terms such as “amateur hour”, “unprofessional” and ”stupid” to describe their colleague Optusdata, whose avatar is a female cartoon with short purple hair.

The supposed hacker has since gone quiet, not appearing on the online forum BreachForums since Tuesday, when they apologised to both Optus and its customers.

Optusdata’s reputation score, which is voted on by other users, is sitting at minus 41 on the forum, following heavy criticism for the about-face.

The alleged hacker claimed it was a “mistake” to publish the data in the first place and deleted the sample data of 10,000 Australians they had earlier posted.

The user did not respond to requests for comment.

Meanwhile the reputational damage from Optus’s major data breach could lead to customers moving to rival telcos and could undermine its market share and margins, according to credit rating agency S&P Global.

The cyber attack, which has affected some 10 million customers, remains under investigation but raised governance concerns about Optus’s ability to manage its risks, and in particular the robustness of its cyber defences, S&P analysts said.

“The longer-term reputational impact of the breach remains a rating focus. This includes how it will affect Optus’s market share and its ability to sustain its pricing and average revenue per user,” an S&P statement said.

“A key influence on this will be customer perceptions of the adequacy of Optus’s response and the extent to which investigations reveal any fundamental flaws in the group’s cyber­security systems and governance practices. We believe Optus’s customer base will have limited tolerance for any material subsequent data breaches, thereby increasing franchise risks relative to peers if it happens again.”

Additional reporting: Nicholas Jensen