Optus statement on commencement of ACMA Federal Court proceedings

Statement to be attributed to Optus Interim CEO, Michael Venter

Optus acknowledges the release of documents in connection with the proceedings the Australian Communications and Media Authority (ACMA) has lodged in the Federal Court in respect of the 2022 cyberattack.

Optus deeply regrets the cyberattack occurred.  Our customers expected their information would remain safe.  We accept that this did not happen, and the cyber attacker gained unauthorised access to some of their information.

Since the cyberattack, our focus has been on protecting our customers, alerting them to be vigilant at the time of the attack, providing credit monitoring services, reimbursing the costs of replacing identity documents where required and ensuring that we continue to uplift our cyber capabilities.

The cyberattack resulted from the cyber attacker being able to exploit a previously unknown vulnerability in our defences that arose from a historical coding error. 

This vulnerability was exploited by a motivated and determined criminal as they probed our defences, and then exploited and evaded these defences by taking steps to bypass various authentication and detection controls that were in place to protect our customers’ data. The criminal did this by mimicking usual customer activity and rotating through tens of thousands of different IP addresses to evade detection.

Regrettably, the attack also resulted in the release of customer identity information of 10,200 customers on the dark web.  The attack did not impact any credit card or bank account information, or customer passwords.

After the criminal attack Optus addressed the vulnerability, and has since reviewed its systems and processes, and continued to invest to uplift its cyber defences to meet the heightened global cyber risk environment. 

Optus recognises that we still have much to do to fully regain our customers’ trust and we will continue to work tirelessly towards this goal.

Optus is working with the ACMA and separately Slater and Gordon with the intention of providing them with a confidential version of the Deloitte Report that appropriately protects our customer data and systems from cybercriminals.

As the regulator of the telecommunications sector, the ACMA plays a critical role in our sector, including to enforce the legislative powers that have been conferred on it.

Optus will continue to cooperate with the ACMA on this matter, although it intends to defend this action and where necessary, correct the record. It will ultimately be a matter for the Federal Court to determine whether there has been any breach or the appropriateness of any sanctions against Optus. 

- ENDS –

Optus Corporate Affairs 

Kathy Lipari 
(02) 9037 8179  
media@optus.com.au