Optus boss says ‘skilled criminal’ behind cyberattack, admits telco lost customers

The chief executive of Optus has maintained that the cyberattack on her telco in September was perpetrated by a skilled cyber criminal and revealed the company lost customers in its immediate aftermath.

At a business summit in Sydney on Wednesday, Optus boss Kelly Bayer Rosmarin said the attack was carried out by a motivated individual and crafted specifically for the company.

Optus chief executive Kelly Bayer Rosmarin said the company did not pay a ransom.Credit: Michael Quelch

“The cyberattack was not a casual crime of opportunity,” Rosmarin said. “The skilled criminal had knowledge of Optus’ systems and cycled through many tens of thousands of internet protocol addresses in an attempt to evade our automated cyber monitoring.”

In September, Optus’ systems were breached in one of the largest cyberattacks in Australian history, accessing names, dates of birth, phone numbers, email addresses, physical addresses and driver’s licence numbers of millions of the telecommunications giant’s customers.

Optus and the federal government were at loggerheads at the time over the nature of the attack, with Home Affairs Minister Clare O’Neil suggesting the attack was a very simple one. “What is of concern for us is how what is quite a basic hack was undertaken on Optus,” she told the ABC last year.

Rosmarin said Optus refused to pay a ransom to the hacker and that the initial motive of the attack was likely to be the extraction of data for other scam purposes.

“We never paid a ransom,” Rosmarin said. “You can’t assume the hacker was actually planning to do a ransom in the first place. It looks like a bit of an odd attempt. The most likely scenarios were SIM swaps and phishing, which was shut down by going public so quickly.”

The Optus boss also admitted the telco had lost customers immediately after the hack.

“Of course, in the immediate aftermath, there were customers who decided to leave us and that is understandable,” Rosmarin said. “But I think some reports were greatly exaggerated. We are already back in a position of being net customer positive, or growing our customer base.”

Last month, the federal government considered banning ransom payments to cyber criminals because it could encourage more hacking attempts, such as the one that health insurer Medibank suffered last year.

But as experts predict a further escalation in cybercrime this year, Rosmarin said it was not feasible to rule out paying ransoms.

“Everyone has a policy of not paying ransoms, but it’s too absolutist to say ‘never’, given that the evidence doesn’t suggest that,” she said.

Narelle Devine, Telstra chief information security officer, Asia Pacific, also said there were instances where payment of a ransom may be justified. “There are some very small, niche cases where there might be some circumstances where companies go, ‘actually, now we need to do that’.”

Rosmarin said she could not divulge further details about the cyberattack because there was an ongoing criminal investigation into the matter.

The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.